Vulnerabilities

TI-2023-16581 CVE-2023-33559 · GHSA-hgjj-3x23-5xv2

A local file inclusion vulnerability via the lang parameter in OcoMon before v4.0.1…

MEDIUM 41

A local file inclusion vulnerability via the lang parameter in OcoMon before v4.0.1 allows attackers to execute arbitrary code by supplying a crafted PHP file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00755 Published 2023-10-26 No fix listed CWE-829

TI-2023-16580 CVE-2023-33558 · GHSA-pxm4-75xf-9fq8

An information disclosure vulnerability in the component users-grid-data.php of Ocomon…

MEDIUM 40

An information disclosure vulnerability in the component users-grid-data.php of Ocomon before v4.0.1 allows attackers to obtain sensitive information such as e-mails and usernames.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00629 Published 2023-10-26 No fix listed CWE-200

TI-2022-19406 CVE-2022-40798 · GHSA-73hh-p4j2-j7gj

OcoMon 4.0RC1 is vulnerable to Incorrect Access Control.

HIGH 72

OcoMon 4.0RC1 is vulnerable to Incorrect Access Control.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01024 Published 2022-10-19 No fix listed CWE-284

TI-2022-19858 CVE-2022-41391 · GHSA-p994-97w6-6qr3

OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at showImg.php.

MEDIUM 51

OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at showImg.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00922 Published 2022-10-13 No fix listed CWE-79

TI-2022-19857 CVE-2022-41390 · GHSA-gcqr-34hj-8f3c

OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at download.php.

MEDIUM 51

OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at download.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00922 Published 2022-10-13 No fix listed CWE-89

Vulnerabilities

Filters

A local file inclusion vulnerability via the lang parameter in OcoMon before v4.0.1…

An information disclosure vulnerability in the component users-grid-data.php of Ocomon…

OcoMon 4.0RC1 is vulnerable to Incorrect Access Control.

OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at showImg.php.

OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at download.php.