Vulnerabilities

TI-2019-05461 CVE-2019-7748 · GHSA-wjpx-gpqg-2p83

_includes\online.php in DbNinja 3.2.7 allows XSS via the data.php task parameter if _users/admin/tasks.php exists.

LOW 29

_includes\online.php in DbNinja 3.2.7 allows XSS via the data.php task parameter if _users/admin/tasks.php exists.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00865 Published 2019-02-11 No fix listed CWE-79

TI-2019-05460 CVE-2019-7747 · GHSA-pq5g-9f89-6chp

MEDIUM 44

DbNinja 3.2.7 allows session fixation via the data.php sessid parameter.

CVSS 3.0CRITICAL 9.6 Network No auth User interaction EPSS 0.01395 Published 2019-02-11 No fix listed CWE-384

TI-2019-05326 CVE-2019-7545 · GHSA-fq3j-c7c8-2p4x

LOW 26

In DbNinja 3.2.7, the Add Host function of the Manage Hosts pages has a Stored Cross-site Scripting (XSS) vulnerability in the User Name field.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00667 Published 2019-02-06 No fix listed CWE-79