CVE-2024-25533

all versions

Error messages in RuvarOA v6.01 and v12.01 were discovered to leak the physical path of the website (/WorkFlow/OfficeFileUpdate.as

9.4CRITICAL

CVE-2024-25532

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the bt_id parameter at /include/get_dict.asp

9.8CRITICAL

CVE-2024-25528

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_

5.9MEDIUM

CVE-2024-25531

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/SearchCo

9.8CRITICAL

CVE-2024-25530

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/get_find

9.8CRITICAL

CVE-2024-25529

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /WorkFlow/wf_office_file

9.8CRITICAL

CVE-2024-25527

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_

9.4CRITICAL

CVE-2024-25526

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the project_id parameter at /ProjectManage/p

8.1HIGH

CVE-2024-25525

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the filename parameter at /WorkFlow/OfficeFi

9.8CRITICAL

CVE-2024-25524

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkPl

9.4CRITICAL

CVE-2024-25523

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /filemanage/file_me

9.8CRITICAL

CVE-2024-25522

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the office_missive_id parameter at /WorkFlow

9.4CRITICAL

CVE-2024-25521

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the txt_keyword parameter at get_company.asp

9.4CRITICAL

CVE-2024-25520

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /SysManage/sys_blogtempl

9.8CRITICAL

CVE-2024-25519

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the idlist parameter at /WorkFlow/wf_work_pr

9.8CRITICAL

CVE-2024-25518

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /WorkFlow/wf_ge

9.4CRITICAL

CVE-2024-25517

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the tbTable argument at /WebUtility/MF.aspx.

9.8CRITICAL

CVE-2024-25515

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFl

7.3HIGH

CVE-2024-25514

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /SysManage/wf_t

9.4CRITICAL

CVE-2024-25513

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /CorporateCulture/k

7.8HIGH

CVE-2024-25511

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/address_pub

9.4CRITICAL

CVE-2024-25510

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/address_pub

9.8CRITICAL

CVE-2024-25509

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFl

9.4CRITICAL

CVE-2024-25512

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the attach_id parameter at /Bulletin/AttachD

8.1HIGH

CVE-2024-25508

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /bulletin/bulletin_templ

9.8CRITICAL

CVE-2024-25507

all versions

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the email_attach_id parameter at /LHMail/Att

9.4CRITICAL