Vulnerabilities > Testlink > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-08-26 | CVE-2024-42906 | Cross-site Scripting vulnerability in Testlink TestLink before v.1.9.20 is vulnerable to Cross Site Scripting (XSS) via the pop-up on upload file. | 6.1 |
| 2022-09-16 | CVE-2022-35194 | Cross-site Scripting vulnerability in Testlink 1.9.20 TestLink v1.9.20 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /lib/inventory/inventoryView.php. | 5.4 |
| 2020-01-20 | CVE-2019-20381 | Cross-site Scripting vulnerability in Testlink TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. | 6.1 |
| 2019-12-02 | CVE-2019-19491 | Cross-site Scripting vulnerability in Testlink 1.9.19 TestLink 1.9.19 has XSS via the lib/testcases/archiveData.php edit parameter, the index.php reqURI parameter, or the URI in a lib/testcases/tcEdit.php?doAction=doDeleteStep request. | 6.1 |
| 2019-08-01 | CVE-2019-14471 | Cross-site Scripting vulnerability in Testlink 1.9.19 TestLink 1.9.19 has XSS via the error.php message parameter. | 6.1 |
| 2017-09-26 | CVE-2015-7391 | Cross-site Scripting vulnerability in Testlink Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the (1) selected_end_date or (2) selected_start_date parameter to lib/results/tcCreatedPerUserOnTestProject.php; the (3) containerType parameter to lib/testcases/containerEdit.php; the (4) filter_tc_id or (5) filter_testcase_name parameter to lib/testcases/listTestCases.php; the (6) useRecursion parameter to lib/testcases/tcImport.php; the (7) targetTestCase or (8) created_by parameter to lib/testcases/tcSearch.php; or the (9) HTTP Referer header to third_party/user_contribution/fakeRemoteExecServer/client4fakeXMLRPCTestRunner.php. | 6.1 |