Vendor
9 published CVES affecting corebos, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first
Corebos 8.0 and below is vulnerable to CSV Injection. An attacker with low privileges can inject a malicious command into a table. This vulnerability is exploited when an administrator visits the user management section, exports the data to a CSV file, and then opens it, leading...
Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8 via evvtgendoc.
Cross-Site Request Forgery (CSRF) in GitHub repository tsolucio/corebos prior to 8.
Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
Unverified Password Change in GitHub repository tsolucio/corebos prior to 8.
Cross-site Scripting (XSS) - Generic in GitHub repository tsolucio/corebos prior to 8.0.
PHP Remote File Inclusion in GitHub repository tsolucio/corebos prior to 8.0.
coreBOS version 7.0 and earlier contains a Incorrect Access Control vulnerability in Module: Contacts that can result in The error allows you to access records that you have no permissions to. .
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.