Vulnerabilities > Idattend

DATE CVE VULNERABILITY TITLE RISK
2023-10-25 CVE-2023-26577 Cross-site Scripting vulnerability in Idattend Idweb 3.1.013/3.1.052
Stored cross-site scripting in the IDAttend’s IDWeb application 3.1.052 and earlier allows attackers to hijack the browsing session of the logged in user.
network
low complexity
idattend CWE-79
5.4
2023-10-25 CVE-2023-26578 Unrestricted Upload of File with Dangerous Type vulnerability in Idattend Idweb 3.1.013
Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP or ASPX, gaining command execution on the affected server.
network
low complexity
idattend CWE-434
8.8
2023-10-25 CVE-2023-26579 Missing Authentication for Critical Function vulnerability in Idattend Idweb 3.1.013
Missing authentication in the DeleteStaff method in IDAttend’s IDWeb application 3.1.013 allows deletion of staff information by unauthenticated attackers.
network
low complexity
idattend CWE-306
5.3
2023-10-25 CVE-2023-26580 Files or Directories Accessible to External Parties vulnerability in Idattend Idweb 3.1.013/3.1.052
Unauthenticated arbitrary file read in the IDAttend’s IDWeb application 3.1.013 allows the retrieval of any file present on the web server by unauthenticated attackers.
network
low complexity
idattend CWE-552
7.5
2023-10-25 CVE-2023-26581 SQL Injection vulnerability in Idattend Idweb 3.1.013/3.1.052
Unauthenticated SQL injection in the GetVisitors method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.
network
low complexity
idattend CWE-89
critical
9.1
2023-10-25 CVE-2023-26582 SQL Injection vulnerability in Idattend Idweb 3.1.013/3.1.052
Unauthenticated SQL injection in the GetExcursionDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.
network
low complexity
idattend CWE-89
critical
9.1
2023-10-25 CVE-2023-26583 SQL Injection vulnerability in Idattend Idweb 3.1.013/3.1.052
Unauthenticated SQL injection in the GetCurrentPeriod method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.
network
low complexity
idattend CWE-89
critical
9.1
2023-10-25 CVE-2023-26584 SQL Injection vulnerability in Idattend Idweb 3.1.013/3.1.052
Unauthenticated SQL injection in the GetStudentInconsistencies method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.
network
low complexity
idattend CWE-89
critical
9.1
2023-10-25 CVE-2023-27254 SQL Injection vulnerability in Idattend Idweb 3.1.013/3.1.052
Unauthenticated SQL injection in the GetRoomChanges method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.
network
low complexity
idattend CWE-89
critical
9.1
2023-10-25 CVE-2023-27255 SQL Injection vulnerability in Idattend Idweb 3.1.013/3.1.052
Unauthenticated SQL injection in the DeleteRoomChanges method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.
network
low complexity
idattend CWE-89
critical
9.1