Vulnerabilities

TI-2017-12952 CVE-2017-17696 · GHSA-p8jp-9m8q-hqr6

Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an…

LOW 21

Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00708 Published 2017-12-15 No fix listed CWE-200

TI-2017-12951 CVE-2017-17695 · GHSA-r9x2-vv96-35p2

Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter.

MEDIUM 40

Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.00961 Published 2017-12-15 No fix listed CWE-89

TI-2017-12950 CVE-2017-17694 · GHSA-65fm-433f-r44v

Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter.

LOW 25

Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00513 Published 2017-12-15 No fix listed CWE-79

TI-2017-12949 CVE-2017-17693 · GHSA-jc5f-jq4r-gpw4

Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for…

LOW 21

Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delete requests that remove feedback.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00553 Published 2017-12-15 No fix listed CWE-862

TI-2017-12560 CVE-2017-17110 · GHSA-32h6-678g-3xvh

Techno Portfolio Management Panel 1.0 allows an attacker to inject SQL commands via a single.php?id= request.

MEDIUM 53

Techno Portfolio Management Panel 1.0 allows an attacker to inject SQL commands via a single.php?id= request.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0858 Published 2017-12-11 No fix listed CWE-89

Vulnerabilities

Filters

Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an…

Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter.

Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter.

Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for…

Techno Portfolio Management Panel 1.0 allows an attacker to inject SQL commands via a single.php?id= request.