Vulnerabilities

TI-2012-04895 CVE-2012-5866 · GHSA-j9v8-h4rq-56rx

Cross-site scripting (XSS) vulnerability in include.php in Achievo 1.4.5 allows remote…

LOW 22

Cross-site scripting (XSS) vulnerability in include.php in Achievo 1.4.5 allows remote attackers to inject arbitrary web script or HTML via the field parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01201 Published 2014-10-20 No fix listed CWE-79

TI-2012-04894 CVE-2012-5865 · GHSA-wh2j-gcwg-637v

SQL injection vulnerability in dispatch.php in Achievo 1.4.5 allows remote authenticated…

LOW 31

SQL injection vulnerability in dispatch.php in Achievo 1.4.5 allows remote authenticated users to execute arbitrary SQL commands via the activityid parameter in a stats action.

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01123 Published 2014-10-20 No fix listed CWE-89

TI-2011-03254 CVE-2011-3697 · GHSA-wggr-g2f8-f7m4

Achievo 1.4.5 allows remote attackers to obtain sensitive information via a direct…

LOW 26

Achievo 1.4.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/graph/jpgraph/jpgraph_radar.p…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01335 Published 2011-09-23 No fix listed CWE-200

TI-2009-03529 CVE-2009-3705 · GHSA-hf26-jxgm-p96m

PHP remote file inclusion vulnerability in debugger.php in Achievo before 1.4.0 allows…

MEDIUM 45

PHP remote file inclusion vulnerability in debugger.php in Achievo before 1.4.0 allows remote attackers to execute arbitrary PHP code via a URL in the config_atkroot parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.09813 Published 2009-10-16 No fix listed CWE-94

TI-2009-02608 CVE-2009-2734 · GHSA-prgp-qwrq-6qh6

SQL injection vulnerability in the get_employee function in classweekreport.inc in…

LOW 35

SQL injection vulnerability in the get_employee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter (aka user_id variable) to dispatc…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01256 Published 2009-10-16 No fix listed CWE-89

TI-2009-02607 CVE-2009-2733 · GHSA-94w4-5268-h2hr

Multiple cross-site scripting (XSS) vulnerabilities in Achievo before 1.4.0 allow remote…

LOW 24

Multiple cross-site scripting (XSS) vulnerabilities in Achievo before 1.4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the scheduler title in the scheduler module, and the (2) atksearch[contrac…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02263 Published 2009-10-16 No fix listed CWE-79

TI-2008-05731 CVE-2008-6035 · GHSA-m7gm-87w2-c4mv

Cross-site scripting (XSS) vulnerability in dispatch.php in Achievo 1.3.2-STABLE allows…

LOW 22

Cross-site scripting (XSS) vulnerability in dispatch.php in Achievo 1.3.2-STABLE allows remote attackers to inject arbitrary web script or HTML via the atknodetype parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01068 Published 2009-02-03 No fix listed CWE-79

TI-2008-05730 CVE-2008-6034 · GHSA-8fcw-jq9c-7vgq

Cross-site scripting (XSS) vulnerability in dispatch.php in Achievo 1.3.2 allows remote…

LOW 23

Cross-site scripting (XSS) vulnerability in dispatch.php in Achievo 1.3.2 allows remote attackers to inject arbitrary web script or HTML via the atkaction parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01446 Published 2009-02-03 No fix listed CWE-79

TI-2008-02617 CVE-2008-2742 · GHSA-rrgm-3qrm-8r6m

Unrestricted file upload in the mcpuk file editor…

MEDIUM 40

Unrestricted file upload in the mcpuk file editor (atk/attributes/fck/editor/filemanager/browser/mcpuk/connectors/php/config.php) in Achievo 1.2.0 through 1.3.2 allows remote attackers to execute arbitrary code by upload…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04714 Published 2008-06-17 No fix listed CWE-20

TI-2007-02647 CVE-2007-2736 · GHSA-ppjx-2jv5-vpwr

PHP remote file inclusion vulnerability in index.php in Achievo 1.1.0 allows remote…

MEDIUM 50

PHP remote file inclusion vulnerability in index.php in Achievo 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the config_atkroot parameter.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.04093 Published 2007-05-17 No fix listed

TI-2006-02596 CVE-2006-2688 · GHSA-c9q9-j66q-9r97

SQL injection vulnerability in the employees node (class.employee.inc) in Achievo 1.1.0…

LOW 31

SQL injection vulnerability in the employees node (class.employee.inc) in Achievo 1.1.0 and earlier and 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the atkselector parameter.

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.01315 Published 2006-05-31 No fix listed

TI-2002-01357 CVE-2002-1435 · GHSA-xfr5-86r6-8jvf

class.atkdateattribute.js.php in Achievo 0.7.0 through 0.9.1, except 0.8.2, allows remote…

MEDIUM 43

class.atkdateattribute.js.php in Achievo 0.7.0 through 0.9.1, except 0.8.2, allows remote attackers to execute arbitrary PHP code when the 'allow_url_fopen' setting is enabled via a URL in the config_atkroot parameter th…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0684 Published 2004-09-01 No fix listed

Vulnerabilities

Filters