Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Jorani 1.0.4 Clear all filters
TI-2026-71986 CVE-2026-110100 · GHSA-67px-h38p-mh8v

Missing authorization in Jorani lets users import days off into any contract

Priority LOW 23

Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days off into any contract from an arbitrary URL.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00223 Published 2026-10-13 Fixed in 1.0.4 CWE-862
TI-2026-71985 CVE-2026-110099 · GHSA-cf27-x93f-gg54

Missing authorization in Jorani HR export actions lets users export data

Priority LOW 24

Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated user to export HR data.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00251 Published 2026-10-13 Fixed in 1.0.4 CWE-862
TI-2026-71984 CVE-2026-110098 · GHSA-jhv7-7892-gg9h

Insecure direct object reference in Jorani leave and overtime requests

Priority LOW 24

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00235 Published 2026-10-13 Fixed in 1.0.4 CWE-639