Vulnerabilities

TI-2024-19648 CVE-2024-29879 · GHSA-6qxg-84xw-6m8w

Cross-site scripting in Sentrifugo

LOW 32

Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00489 Published 2024-03-21 No fix listed CWE-79

TI-2024-19647 CVE-2024-29878 · GHSA-2vwx-x49m-q6hr

Cross-site scripting in Sentrifugo

LOW 32

Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/sitepreference/add, 'description' parameter.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00489 Published 2024-03-21 No fix listed CWE-79

TI-2024-19646 CVE-2024-29877 · GHSA-f64p-xgr6-r5f4

Cross-site scripting in Sentrifugo

LOW 32

Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/expenses/expensecategories/edit, 'expense_category_name' parameter.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00502 Published 2024-03-21 No fix listed CWE-79

TI-2024-19645 CVE-2024-29876 · GHSA-qqp2-2gr9-622w

SQL injection in Sentrifugo

MEDIUM 44

SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/reports/activitylogreport, 'sortby' parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00825 Published 2024-03-21 No fix listed CWE-89

TI-2024-19644 CVE-2024-29875 · GHSA-44mc-ggjv-3xj6

SQL injection in Sentrifugo

MEDIUM 50

SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/default/reports/exportactiveuserrpt, 'sort_name' parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00874 Published 2024-03-21 No fix listed CWE-89

TI-2024-19643 CVE-2024-29874 · GHSA-3525-gmp6-g5m5

SQL injection in Sentrifugo

MEDIUM 50

SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/default/reports/activeuserrptpdf, 'sort_name' parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00874 Published 2024-03-21 No fix listed CWE-89

TI-2024-19642 CVE-2024-29873 · GHSA-cxq6-hcg5-hcjv

SQL injection in Sentrifugo

MEDIUM 50

SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/reports/businessunits/format/html, 'bunitname' parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00825 Published 2024-03-21 No fix listed CWE-89

TI-2024-19641 CVE-2024-29872 · GHSA-mgmq-g3mf-5h3g

SQL injection in Sentrifugo

MEDIUM 50

SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/empscreening/add, 'agencyids' parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00825 Published 2024-03-21 No fix listed CWE-89

TI-2024-19640 CVE-2024-29871 · GHSA-j67q-hvmw-6m2r

SQL injection in Sentrifugo

MEDIUM 50

SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/sentrifugo/index.php/index/updatecontactnumber, 'id' parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00856 Published 2024-03-21 No fix listed CWE-89

TI-2024-19639 CVE-2024-29870 · GHSA-j95q-fjjg-wf7f

SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter./sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00856 Published 2024-03-21 No fix listed CWE-89

TI-2023-14012 CVE-2023-29770 · GHSA-rhm3-5ppf-x22h

In Sentrifugo 3.5, the AssetsController::uploadsaveAction function allows an…

MEDIUM 40

In Sentrifugo 3.5, the AssetsController::uploadsaveAction function allows an authenticated attacker to upload any file without extension filtering.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00906 Published 2023-11-27 No fix listed CWE-434

TI-2020-17203 CVE-2020-28365 · GHSA-x8gm-jvwx-xhv6

Sentrifugo 3.2 allows Stored Cross-Site Scripting (XSS) vulnerability by inserting a…

LOW 28

Sentrifugo 3.2 allows Stored Cross-Site Scripting (XSS) vulnerability by inserting a payload within the X-Forwarded-For HTTP header during the login process.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00699 Published 2020-12-30 No fix listed CWE-79

TI-2020-16270 CVE-2020-26803 · GHSA-mrj6-v8w9-4v5f

In Sentrifugo 3.2, users can upload an image under "Assets -> Add" tab.

MEDIUM 41

In Sentrifugo 3.2, users can upload an image under "Assets -> Add" tab.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01411 Published 2020-11-12 No fix listed CWE-434

TI-2020-16271 CVE-2020-26804 · GHSA-6jgh-69hg-fvcw

In Sentrifugo 3.2, users can share an announcement under "Organization -> Announcements"…

MEDIUM 41

In Sentrifugo 3.2, users can share an announcement under "Organization -> Announcements" tab.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01411 Published 2020-11-12 No fix listed CWE-434

TI-2020-16272 CVE-2020-26805 · GHSA-p6rg-53wx-7278

In Sentrifugo 3.2, admin can edit employee's informations via this endpoint -->…

LOW 35

In Sentrifugo 3.2, admin can edit employee's informations via this endpoint --> /sentrifugo/index.php/empadditionaldetails/edit/userid/2.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01505 Published 2020-11-12 No fix listed CWE-89

TI-2020-08232 CVE-2020-10218 · GHSA-rvc2-pw96-7pj9

A Blind SQL Injection issue was discovered in Sapplica Sentrifugo 3.2 via the…

LOW 31

A Blind SQL Injection issue was discovered in Sapplica Sentrifugo 3.2 via the index.php/holidaygroups/add id parameter because of the HolidaydatesController.php addAction function.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01164 Published 2020-03-13 No fix listed CWE-89

TI-2019-12068 CVE-2019-16059 · GHSA-7774-4928-rfp7

Sentrifugo 3.2 lacks CSRF protection.

LOW 39

Sentrifugo 3.2 lacks CSRF protection.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00614 Published 2019-09-06 No fix listed CWE-352

TI-2018-11316 CVE-2018-15873 · GHSA-2wx7-cf6v-q9v8

A SQL Injection issue was discovered in Sentrifugo 3.2 via the deptid parameter.

MEDIUM 44

A SQL Injection issue was discovered in Sentrifugo 3.2 via the deptid parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01135 Published 2018-08-28 No fix listed CWE-89

Vulnerabilities

Filters