emlsoft project vulnerabilities

Products

• emlsoft 5

Latest emlsoft project CVEs

Newest publication first

1. CVE-2018-14968 An issue was discovered in EMLsoft 5.4.5. upload\eml\action\action.address.php has SQL Injection via the numPerPage parameter.

   Published 2018-08-06

   Critical·CVSS 9.8 EPSS 1.1%

   An issue was discovered in EMLsoft 5.4.5. upload\eml\action\action.address.php has SQL Injection via the numPerPage parameter.

2. CVE-2018-14967 An issue was discovered in EMLsoft 5.4.5. upload\eml\action\action.user.php has SQL Injection via the numPerPage parameter.

   Published 2018-08-06

   High·CVSS 8.8 EPSS 1.00%

   An issue was discovered in EMLsoft 5.4.5. upload\eml\action\action.user.php has SQL Injection via the numPerPage parameter.

3. CVE-2018-14966 An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=user&do=add page allows CSRF.

   Published 2018-08-06

   High·CVSS 8.8 EPSS 0.49%

   An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=user&do=add page allows CSRF.

4. CVE-2018-14965 An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=address&do=add page allows CSRF.

   Published 2018-08-06

   High·CVSS 8.8 EPSS 0.49%

   An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=address&do=add page allows CSRF.

5. CVE-2018-14964 An issue was discovered in EMLsoft 5.4.5. XSS exists via the eml/upload/eml/?action=address&do=edit page.

   Published 2018-08-06

   Medium·CVSS 5.4 EPSS 0.53%

   An issue was discovered in EMLsoft 5.4.5. XSS exists via the eml/upload/eml/?action=address&do=edit page.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.