Vulnerabilities

TI-2024-31085 CVE-2024-46655 · GHSA-3273-8cp5-whhv

A reflected cross-site scripting (XSS) vulnerability in Ellevo 6.2.0.38160 allows…

MEDIUM 60

A reflected cross-site scripting (XSS) vulnerability in Ellevo 6.2.0.38160 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload or URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00377 Published 2024-09-25 No fix listed CWE-79

TI-2024-28603 CVE-2024-42760 · GHSA-cvgf-c753-74qx

SQL Injection vulnerability in Ellevo v.6.2.0.38160 allows a remote attacker to obtain…

MEDIUM 40

SQL Injection vulnerability in Ellevo v.6.2.0.38160 allows a remote attacker to obtain sensitive information via the /api/mob/instrucao/conta/destinatarios component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00571 Published 2024-09-11 No fix listed CWE-89

TI-2024-28602 CVE-2024-42759 · GHSA-vw78-5596-vx6r

An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the…

MEDIUM 63

An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the /api/usuario/cadastrodesuplente endpoint.

CVSS 3.1MEDIUM 6.3 Local High privileges No interaction EPSS 0.00359 Published 2024-09-09 No fix listed CWE-592

Vulnerabilities

Filters

A reflected cross-site scripting (XSS) vulnerability in Ellevo 6.2.0.38160 allows…

SQL Injection vulnerability in Ellevo v.6.2.0.38160 allows a remote attacker to obtain…

An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the…