Softwarepublico

Records10All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

Softwarepublico records in CISA KEV

No Softwarepublico vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

5 records in E-sic · all components

TI-2017-11292 CVE-2017-15379 · GHSA-fj7f-rgcf-77qm

MEDIUM 47

An authentication bypass exists in the E-Sic 1.0 /index (aka login) URI via '=''or' values for the username and password.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0273 Published 2017-10-23 No fix listed CWE-89

TI-2017-11294 CVE-2017-15381 · GHSA-grxx-hc63-h45x

MEDIUM 45

SQL Injection exists in E-Sic 1.0 via the f parameter to esiclivre/restrito/inc/buscacep.php (aka the zip code search script).

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01482 Published 2017-10-23 No fix listed CWE-89

TI-2017-11286 CVE-2017-15373 · GHSA-gwhp-hcwr-wmwv

MEDIUM 45

E-Sic 1.0 allows SQL injection via the q parameter to esiclivre/restrito/inc/lkpcep.php (aka the search private area).

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01706 Published 2017-10-16 No fix listed CWE-89

TI-2017-11291 CVE-2017-15378 · GHSA-v2q5-6v56-46r3

MEDIUM 41

SQL Injection exists in the E-Sic 1.0 password reset parameter (aka the cpfcnpj parameter to the /reset URI).

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01403 Published 2017-10-23 No fix listed CWE-89

TI-2017-11293 CVE-2017-15380 · GHSA-jxqv-8prh-c98f

LOW 29

XSS exists in the E-Sic 1.0 /cadastro/index.php URI (aka the requester's registration area) via the nome parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00818 Published 2017-10-23 No fix listed CWE-79