Vulnerabilities

TI-2023-22071 CVE-2023-41642 · GHSA-6p75-39hf-wqx7

Multiple reflected cross-site scripting (XSS) vulnerabilities in the…

MEDIUM 60

Multiple reflected cross-site scripting (XSS) vulnerabilities in the ErroreNonGestito.aspx component of GruppoSCAI RealGimm 1.1.37p38 allow attackers to execute arbitrary Javascript in the context of a victim user's brow…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01117 Published 2023-08-31 No fix listed CWE-79

TI-2023-22070 CVE-2023-41640 · GHSA-m7w5-3vfh-m648

An improper error handling vulnerability in the component ErroreNonGestito.aspx of…

HIGH 73

An improper error handling vulnerability in the component ErroreNonGestito.aspx of GruppoSCAI RealGimm 1.1.37p38 allows attackers to obtain sensitive technical information via a crafted SQL query.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01036 Published 2023-08-31 No fix listed CWE-89

TI-2023-22069 CVE-2023-41638 · GHSA-f9rj-wgvv-c77g

An arbitrary file upload vulnerability in the Gestione Documentale module of GruppoSCAI…

HIGH 79

An arbitrary file upload vulnerability in the Gestione Documentale module of GruppoSCAI RealGimm 1.1.37p38 allows attackers to execute arbitrary code via uploading a crafted file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01073 Published 2023-08-31 No fix listed CWE-434

TI-2023-22068 CVE-2023-41637 · GHSA-7jxv-r75g-mvc5

An arbitrary file upload vulnerability in the Carica immagine function of GruppoSCAI…

HIGH 82

An arbitrary file upload vulnerability in the Carica immagine function of GruppoSCAI RealGimm 1.1.37p38 allows attackers to execute arbitrary code via uploading a crafted HTML file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01215 Published 2023-08-31 No fix listed CWE-434

TI-2023-22067 CVE-2023-41636 · GHSA-xfq7-72rr-c7hh

A SQL injection vulnerability in the Data Richiesta dal parameter of GruppoSCAI RealGimm…

HIGH 82

A SQL injection vulnerability in the Data Richiesta dal parameter of GruppoSCAI RealGimm v1.1.37p38 allows attackers to access the database and execute arbitrary commands via a crafted SQL query.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01073 Published 2023-08-31 No fix listed CWE-89

TI-2023-22066 CVE-2023-41635 · GHSA-9fp8-gjq2-822p

A XML External Entity (XXE) vulnerability in the VerifichePeriodiche.aspx component of…

MEDIUM 62

A XML External Entity (XXE) vulnerability in the VerifichePeriodiche.aspx component of GruppoSCAI RealGimm v1.1.37p38 allows attackers to read any file in the filesystem via supplying a crafted XML file.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00794 Published 2023-08-31 No fix listed CWE-776