Vulnerabilities

TI-2019-15635 CVE-2019-25582 · GHSA-5pf3-56wj-95xv

i-doit CMDB 1.12 Arbitrary File Download via file_manager Parameter

MEDIUM 64

i-doit CMDB 1.12 contains an arbitrary file download vulnerability that allows authenticated attackers to download sensitive files by manipulating the file parameter in index.php.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00383 Published 2026-03-21 No fix listed CWE-434

TI-2019-15634 CVE-2019-25581 · GHSA-hvg7-rv27-w39j

i-doit CMDB 1.12 SQL Injection via objGroupID Parameter

HIGH 77

i-doit CMDB 1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the objGroupID parameter.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00365 Published 2026-03-21 No fix listed CWE-89

TI-2024-08117 CVE-2024-8750 · GHSA-cmmj-jc2h-55pm

Cross-site Scripting vulnerability in Idoit pro

LOW 27

Cross-site Scripting (XSS) vulnerability in idoit pro version 28.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0024 Published 2024-09-12 No fix listed CWE-79

TI-2024-08116 CVE-2024-8749 · GHSA-9chw-m2j3-37f5

SQL Injection vulnerability in Idoit pro

MEDIUM 40

SQL injection vulnerability in idoit pro version 28.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00442 Published 2024-09-12 No fix listed CWE-89

TI-2023-24682 CVE-2023-46003 · GHSA-q92r-cx7h-2f3j

I-doit pro 25 and below is vulnerable to Cross Site Scripting (XSS) via index.php.

MEDIUM 58

I-doit pro 25 and below is vulnerable to Cross Site Scripting (XSS) via index.php.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00623 Published 2023-10-21 No fix listed CWE-79

TI-2023-19258 CVE-2023-37756 · GHSA-cg6h-x49r-x24f

I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements…

HIGH 82

I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01449 Published 2023-09-14 No fix listed CWE-521

TI-2023-19257 CVE-2023-37755 · GHSA-xrrp-45rp-88qp

i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default…

HIGH 82

i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01425 Published 2023-09-14 No fix listed CWE-798

TI-2023-19248 CVE-2023-37739 · GHSA-g4wj-5wq2-m9cx

i-doit Pro v25 and below was discovered to be vulnerable to path traversal.

MEDIUM 62

i-doit Pro v25 and below was discovered to be vulnerable to path traversal.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01328 Published 2023-09-14 No fix listed CWE-22

TI-2023-17401 CVE-2023-34830 · GHSA-vv5w-jx3q-w898

i-doit Open v24 was discovered to contain a reflected cross-site scripting (XSS)…

MEDIUM 58

i-doit Open v24 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the timeout parameter on the login page.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00651 Published 2023-06-27 No fix listed CWE-79

TI-2021-02237 CVE-2021-3151 · GHSA-cf7h-gr4c-wwxh

i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could…

LOW 27

i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via C__MONITORING__CONFIG__TITLE, SM2__C__MONITORING__CO…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01221 Published 2021-02-27 No fix listed CWE-79

TI-2020-10811 CVE-2020-13825 · GHSA-2388-5pv7-3f2c

A cross-site scripting (XSS) vulnerability in i-doit 1.14.2 allows remote attackers to…

LOW 29

A cross-site scripting (XSS) vulnerability in i-doit 1.14.2 allows remote attackers to inject arbitrary web script or HTML via the viewMode, tvMode, tvType, objID, catgID, objTypeID, or editMode parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00806 Published 2020-08-19 No fix listed CWE-79

TI-2020-10812 CVE-2020-13826 · GHSA-6vcj-9mc2-44gg

A CSV injection (aka Excel Macro Injection or Formula Injection) issue in i-doit 1.14.2…

MEDIUM 41

A CSV injection (aka Excel Macro Injection or Formula Injection) issue in i-doit 1.14.2 allows an attacker to execute arbitrary commands via a Title parameter that is mishandled in a CSV export.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01499 Published 2020-08-19 No fix listed CWE-1236

TI-2019-16039 CVE-2019-1010248 · GHSA-4xp7-wp89-c7vm

SQL injection in I-doit

MEDIUM 45

Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01421 Published 2019-07-18 No fix listed CWE-89

TI-2019-04901 CVE-2019-6965 · GHSA-95vp-9mr5-fw5q

An XSS issue was discovered in i-doit Open 1.12 via the src/tools/php/qr/qr.php url parameter.

LOW 32

An XSS issue was discovered in i-doit Open 1.12 via the src/tools/php/qr/qr.php url parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02518 Published 2019-06-18 No fix listed CWE-79

TI-2018-14282 CVE-2018-20159 · GHSA-rrfh-v8r9-85q4

i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled.

MEDIUM 44

i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.09891 Published 2018-12-15 No fix listed CWE-20

TI-2014-01764 CVE-2014-2231 · GHSA-q5hx-rg7g-3j6c

Cross-site scripting (XSS) vulnerability in the API in synetics i-doit pro before 1.2.5…

LOW 22

Cross-site scripting (XSS) vulnerability in the API in synetics i-doit pro before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via a property title.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.00931 Published 2014-02-27 No fix listed CWE-79

TI-2014-01247 CVE-2014-1597 · GHSA-25r4-xgpc-p9hq

SQL injection vulnerability in the CMDB web application in synetics i-doit pro before…

LOW 36

SQL injection vulnerability in the CMDB web application in synetics i-doit pro before 1.2.5 and i-doit open allows remote attackers to execute arbitrary SQL commands via the objID parameter to the default URI.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0132 Published 2014-02-27 No fix listed CWE-89

TI-2014-00941 CVE-2014-1237 · GHSA-cwj9-7hqx-ff34

Cross-site scripting (XSS) vulnerability in synetics i-doit pro before 1.2.4 allows…

LOW 24

Cross-site scripting (XSS) vulnerability in synetics i-doit pro before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the call parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01733 Published 2014-02-11 No fix listed CWE-79

TI-2013-01233 CVE-2013-1413 · GHSA-jj38-pjm7-xq96

Multiple cross-site scripting (XSS) vulnerabilities in synetics i-doit open 0.9.9-7…

LOW 22

Multiple cross-site scripting (XSS) vulnerabilities in synetics i-doit open 0.9.9-7, i-doit pro 1.0 and earlier, and i-doit pro 1.0.2 when the 'sanitize user input' flag is not enabled, allow remote attackers to inject a…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01161 Published 2014-02-11 No fix listed CWE-79

Vulnerabilities

Filters