Priority LOW 20
A sensitive information disclosure vulnerability exists in the error handling component of ATISoluciones CIGES Application version 2.15.6 and earlier.
CVSS 4.0LOW 2.7· Network · No auth · No interaction · EPSS 0.0041 · Published 2025-11-24 · Fixed in 2.15.6 CWE-200
Priority MEDIUM 49
A SQL Injection vulnerability has been found in Ciges 2.15.5 from ATISoluciones.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00489 · Published 2025-02-27 · No fix listed CWE-89
Priority MEDIUM 49
SQL injection vulnerability in ATISolutions CIGES affecting versions lower than 2.15.5.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00487 · Published 2024-08-26 · Fixed in 2.15.5 CWE-89
Priority LOW 24
Information exposure vulnerability in the CIGESv2 system.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00162 · Published 2024-03-22 · No fix listed CWE-200
Priority LOW 27
HTML injection vulnerability affecting the CIGESv2 system, which allows an attacker to inject arbitrary code and modify elements of the website and email confirmation message.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00309 · Published 2024-03-22 · No fix listed CWE-79
Priority LOW 27
Stored Cross-Site Scripting (Stored-XSS) vulnerability affecting the CIGESv2 system, allowing an attacker to execute and store malicious javascript code in the application form without prior registration.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00309 · Published 2024-03-22 · No fix listed CWE-79
Priority LOW 34
Information exposure vulnerability in the CIGESv2 system.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00624 · Published 2024-03-22 · No fix listed CWE-200
Priority MEDIUM 50
SQL injection vulnerability in the CIGESv2 system, through /ajaxServiciosAtencion.php, in the 'idServicio' parameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00684 · Published 2024-03-22 · No fix listed CWE-89
Priority MEDIUM 44
SQL injection vulnerability in the CIGESv2 system, through /ajaxSubServicios.php, in the 'idServicio' parameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00684 · Published 2024-03-22 · No fix listed CWE-89
Priority MEDIUM 50
SQL injection vulnerability in the CIGESv2 system, through /ajaxConfigTotem.php, in the 'id' parameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00683 · Published 2024-03-22 · No fix listed CWE-89
THREATIST.IORead the docs