Vulnerabilities > Testlink > Testlink > 1.9.5
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-08-26 | CVE-2024-42906 | Cross-site Scripting vulnerability in Testlink TestLink before v.1.9.20 is vulnerable to Cross Site Scripting (XSS) via the pop-up on upload file. | 6.1 |
| 2023-12-30 | CVE-2023-50110 | Unspecified vulnerability in Testlink TestLink through 1.9.20 allows type juggling for authentication bypass because === is not used. | 7.5 |
| 2020-03-05 | CVE-2019-20107 | SQL Injection vulnerability in Testlink Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id parameter to keywordsView.php; the (2) req_spec_id parameter to reqSpecCompareRevisions.php; the (3) requirement_id parameter to reqCompareVersions.php; the (4) build_id parameter to planUpdateTC.php; the (5) tplan_id parameter to newest_tcversions.php; the (6) tplan_id parameter to tcCreatedPerUserGUI.php; the (7) tcase_id parameter to tcAssign2Tplan.php; or the (8) testcase_id parameter to tcCompareVersions.php. | 8.8 |
| 2020-01-20 | CVE-2019-20381 | Cross-site Scripting vulnerability in Testlink TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. | 6.1 |
| 2018-03-05 | CVE-2018-7668 | Information Exposure vulnerability in Testlink TestLink through 1.9.16 allows remote attackers to read arbitrary attachments via a modified ID field to /lib/attachments/attachmentdownload.php. | 7.5 |
| 2017-09-26 | CVE-2015-7391 | Cross-site Scripting vulnerability in Testlink Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the (1) selected_end_date or (2) selected_start_date parameter to lib/results/tcCreatedPerUserOnTestProject.php; the (3) containerType parameter to lib/testcases/containerEdit.php; the (4) filter_tc_id or (5) filter_testcase_name parameter to lib/testcases/listTestCases.php; the (6) useRecursion parameter to lib/testcases/tcImport.php; the (7) targetTestCase or (8) created_by parameter to lib/testcases/tcSearch.php; or the (9) HTTP Referer header to third_party/user_contribution/fakeRemoteExecServer/client4fakeXMLRPCTestRunner.php. | 6.1 |
| 2017-09-26 | CVE-2015-7390 | SQL Injection vulnerability in Testlink SQL injection vulnerability in TestLink before 1.9.14 allows remote attackers to execute arbitrary SQL commands via the apikey parameter to lnl.php. | 9.8 |