Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: Symfonia Clear all filters
TI-2025-01728 CVE-2025-1983 · GHSA-5wc9-7mc8-3qmr

Stored Cross-Site Scripting in Ready_

Priority LOW 24

A cross-site scripting (XSS) vulnerability in Ready_'s File Explorer upload functionality allows injection of arbitrary JavaScript code in filename.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00664 Published 2025-04-16 No fix listed CWE-79
TI-2025-01727 CVE-2025-1982 · GHSA-wv58-fx9p-fw8m

Local File Inclusion in Ready_

Priority LOW 34

Local File Inclusion vulnerability in Ready's attachment upload panel allows low privileged user to provide link to a local file using the file:// protocol thus allowing the attacker to read content of the file.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00595 Published 2025-04-16 No fix listed CWE-552
TI-2025-01726 CVE-2025-1981 · GHSA-97x7-5rrp-gxxp

SQL Injection in Ready_

Priority MEDIUM 43

Improper neutralization of input provided by a low-privileged user into a file search functionality in Ready_'s Invoices module allows for SQL Injection attacks.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00535 Published 2025-04-16 No fix listed CWE-89
TI-2025-01725 CVE-2025-1980 · GHSA-cxj5-mwc8-g86c

Remote Code Execution via Unrestricted File Upload in Ready_

Priority MEDIUM 45

The Ready_ application's Profile section allows users to upload files of any type and extension without restriction.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.01099 Published 2025-04-16 No fix listed CWE-434