Vulnerabilities

SOPlanning is vulnerable to Stored XSS in /feries endpoint.

SOPlanning is vulnerable to Privilege Escalation in user management tab.

SOPlanning is vulnerable to Stored XSS in /status endpoint.

SOPlanning is vulnerable to Stored XSS in /projets endpoint.

SOPlanning is vulnerable to Stored XSS in /taches endpoint.

SOPlanning is vulnerable to Stored XSS in /groupe_form endpoint.

SOPlanning is vulnerable to Predictable Generation of Password Recovery Token.

SOPlanning is vulnerable to Broken Access Control in /status endpoint.

Cross Site Scripting (XSS) vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'LOGOUT_REDIRECT' parameter in '/…

SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php.

A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in /process/upload.php.

SQL injection vulnerability in SOPlanning <1.45, via /soplanning/www/user_groupes.php in the by parameter, which could allow a remote user to submit a specially crafted query, allowing an attacker to retrieve all the inf…

SQL injection vulnerability in SOPlanning <1.45, through /soplanning/www/groupe_list.php, in the by parameter, which could allow a remote user to send a specially crafted query and extract all the information stored on t…

Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/groupe_save.php, in the groupe_id parameter.

Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/xajax_server.php, affecting multiple parameters.

A unauthenticated SQL Injection has been found in the SO Planning tool that occurs when the public view setting is enabled.

A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool.

A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool.

An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the public view setting is enabled.

SOPlanning before 1.47 has Incorrect Access Control because certain secret key information, and the related authentication algorithm, is public.

SoPlanning before 1.47 doesn't correctly check the security key used to publicly share plannings.

SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field.

SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field.

SOPlanning 1.45 allows XSS via the Name or Comment to status.php.

SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajax_server.php.