Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

42 records

Vendor: SOPlanning Clear all filters
TI-2026-29295 CVE-2026-40549 · GHSA-cxrr-8w2f-8vxj

Cross-Site Request Forgery in SOPlanning

Priority LOW 22

SOPlanning is vulnerable to Cross‑Site Request Forgery (CSRF) in groupe_save create, modify and delete endpoints.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00182 Published 2026-06-01 No fix listed CWE-352
TI-2026-29293 CVE-2026-40547 · GHSA-6g52-vww8-5mh5

Path Traversal in SOPlanning

Priority LOW 29

SOPlanning is vulnerable to Path Traversal in backup endpoints.

CVSS 4.0MEDIUM 6.4 Network High privileges No interaction EPSS 0.00447 Published 2026-06-01 No fix listed CWE-22
TI-2026-29292 CVE-2026-40546 · GHSA-fgqx-9q7r-qrvh

Multiple SQL Injections in SOPlanning

Priority MEDIUM 45

SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00211 Published 2026-06-01 No fix listed CWE-89
TI-2026-29291 CVE-2026-40545 · GHSA-g36v-xj2q-4799

Reflected XSS in SOPlanning

Priority LOW 23

SOPlanning is vulnerable to Reflected XSS via the taches parameter.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00404 Published 2026-06-01 No fix listed CWE-79
TI-2026-29290 CVE-2026-40544 · GHSA-hgm3-4mgq-cfx8

Stored XSS in SOPlanning

Priority LOW 23

SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00295 Published 2026-06-01 No fix listed CWE-79
TI-2026-29289 CVE-2026-40543 · GHSA-jrvc-354g-rfch

Missing Authorization in SOPlanning

Priority MEDIUM 44

SOPlanning does not enforce authorization for backup functionalities.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00273 Published 2026-06-01 No fix listed CWE-862
TI-2025-38921 CVE-2025-62731 · GHSA-83gp-m2fc-8ph7

Stored XSS in SOPlanning

Priority LOW 22

SOPlanning is vulnerable to Stored XSS in /feries endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00183 Published 2025-11-20 Fixed in 1.55 CWE-79
TI-2025-38919 CVE-2025-62729 · GHSA-xfmv-jwvw-h264

Stored XSS in SOPlanning

Priority LOW 22

SOPlanning is vulnerable to Stored XSS in /status endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.0018 Published 2025-11-20 Fixed in 1.55 CWE-79
TI-2025-38589 CVE-2025-62297 · GHSA-9gf2-fc34-c75c

Stored XSS in SOPlanning

Priority LOW 22

SOPlanning is vulnerable to Stored XSS in /projets endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.0018 Published 2025-11-20 Fixed in 1.55 CWE-79
TI-2025-38588 CVE-2025-62296 · GHSA-84qf-h2cw-8mc2

Stored XSS in SOPlanning

Priority LOW 22

SOPlanning is vulnerable to Stored XSS in /taches endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.0018 Published 2025-11-20 Fixed in 1.55 CWE-79
TI-2025-38587 CVE-2025-62295 · GHSA-78h9-h7hw-grrr

Stored XSS in SOPlanning

Priority LOW 22

SOPlanning is vulnerable to Stored XSS in /groupe_form endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.0018 Published 2025-11-20 Fixed in 1.55 CWE-79
TI-2025-38586 CVE-2025-62294 · GHSA-vm86-vfwq-9qvc

Predictable Generation of Password Recovery Token

Priority MEDIUM 44

SOPlanning is vulnerable to Predictable Generation of Password Recovery Token.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00324 Published 2025-11-20 Fixed in 1.55 CWE-340
TI-2025-38585 CVE-2025-62293 · GHSA-xq7p-cgf2-m4vv

Broken Access Control in SOPlanning

Priority LOW 23

SOPlanning is vulnerable to Broken Access Control in /status endpoint.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00182 Published 2025-11-20 Fixed in 1.55 CWE-862
TI-2025-27354 CVE-2025-41001 · GHSA-7624-hjwj-5xx6

Cross-Site Scripting (XSS) in SOPlanning

Priority LOW 23

Cross Site Scripting (XSS) vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'LOGOUT_REDIRECT' parameter in '/…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00207 Published 2025-11-10 No fix listed CWE-79
TI-2024-08883 CVE-2024-9574 · GHSA-5mch-6pwv-9qcv

SQL Injection vulnerability in SOPlanning

Priority MEDIUM 43

SQL injection vulnerability in SOPlanning <1.45, via /soplanning/www/user_groupes.php in the by parameter, which could allow a remote user to submit a specially crafted query, allowing an attacker to retrieve all the inf…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00531 Published 2024-10-07 Fixed in 1.45 CWE-89
TI-2024-08882 CVE-2024-9573 · GHSA-x9gf-8wx8-vgh8

SQL Injection vulnerability in SOPlanning

Priority LOW 31

SQL injection vulnerability in SOPlanning <1.45, through /soplanning/www/groupe_list.php, in the by parameter, which could allow a remote user to send a specially crafted query and extract all the information stored on t…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.003 Published 2024-10-07 Fixed in 1.45 CWE-89
TI-2024-08881 CVE-2024-9572 · GHSA-9377-p242-8m6p

Cross-Site Scripting vulnerability in SOPlanning

Priority LOW 28

Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/groupe_save.php, in the groupe_id parameter.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.00286 Published 2024-10-07 Fixed in 1.45 CWE-79
TI-2024-08880 CVE-2024-9571 · GHSA-gxgq-8g7h-rw9j

Cross-Site Scripting vulnerability in SOPlanning

Priority LOW 28

Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/xajax_server.php, affecting multiple parameters.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.00286 Published 2024-10-07 Fixed in 1.45 CWE-79
TI-2024-17972 CVE-2024-27112 · GHSA-84h3-pfxq-r99h

SQL Injection in SOPlanning before 1.52.02

Priority MEDIUM 48

A unauthenticated SQL Injection has been found in the SO Planning tool that occurs when the public view setting is enabled.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00412 Published 2024-09-11 Fixed in 1.52.01 CWE-89
Load more