Vulnerabilities

TI-2025-41130 CVE-2025-67102 · GHSA-g268-rwhc-cj9f

A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an…

LOW 35

A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attacker to execute arbitrary SQL commands via the entity parameter.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00256 Published 2026-02-17 No fix listed CWE-89

TI-2023-02509 CVE-2023-2681 · GHSA-mrxj-gfc5-hf88

SQL Injection on Jorani

MEDIUM 41

An SQL Injection vulnerability has been found on Jorani version 1.0.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00784 Published 2023-10-03 No fix listed CWE-89

TI-2023-11616 CVE-2023-26469 · GHSA-7r9h-9r47-7vjj

In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.

CRITICAL 90

In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.82949 Published 2023-08-17 No fix listed CWE-22

TI-2022-23816 CVE-2022-48118 · GHSA-93p3-m5mh-5pmg

Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter.

LOW 28

Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00478 Published 2023-01-27 No fix listed CWE-79

TI-2022-15055 CVE-2022-34132 · GHSA-6h75-gchv-vpxg

Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter…

MEDIUM 45

Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01582 Published 2022-06-27 No fix listed CWE-89

TI-2022-15057 CVE-2022-34134 · GHSA-cw9p-364w-5rcr

Jorani v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the…

LOW 38

Jorani v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /application/controllers/Users.php.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00445 Published 2022-06-27 No fix listed CWE-352

TI-2022-15056 CVE-2022-34133 · GHSA-375f-cc53-h7vh

Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the…

LOW 28

Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Comment parameter at application/controllers/Leaves.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.006 Published 2022-06-27 No fix listed CWE-79

Vulnerabilities

Filters

A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an…

SQL Injection on Jorani

In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.

Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter.

Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter…

Jorani v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the…

Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the…