SOPlanning

A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in /process/upload.php.

SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php.

Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in Simple Online Planning (SOPPlanning)before 1.33.

Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a ..

A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool.

An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the public view setting is enabled.

A unauthenticated SQL Injection has been found in the SO Planning tool that occurs when the public view setting is enabled.

A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool.

Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers to obtain a calendar owner's password via a brute-force attack on the embedded…

SOPlanning before 1.47 has Incorrect Access Control because certain secret key information, and the related authentication algorithm, is public.

SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters.

SOPlanning is vulnerable to Privilege Escalation in user management tab.

SOPlanning does not enforce authorization for backup functionalities.

SOPlanning is vulnerable to Predictable Generation of Password Recovery Token.

SQL injection vulnerability in SOPlanning <1.45, via /soplanning/www/user_groupes.php in the by parameter, which could allow a remote user to submit a specially crafted query, allowing an attacker to retrieve all the inf…

SOPlanning is vulnerable to SQL injection in the audit retention configuration.

SOPlanning 1.45 has SQL injection via the user_list.php "by" parameter.

SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by export_ical.php.

SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nom_createur&by= substring.

SQL injection vulnerability in SOPlanning <1.45, through /soplanning/www/groupe_list.php, in the by parameter, which could allow a remote user to send a specially crafted query and extract all the information stored on t…

The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, o…

SOPlanning is vulnerable to Path Traversal in backup endpoints.

SoPlanning before 1.47 doesn't correctly check the security key used to publicly share plannings.

SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajax_server.php.

SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajax_server.php.