MediumCVSS 6.8
EPSS 2.7%
Public exploit
Open-AudIT before 2.2 has CSV Injection.
Vendor
open-audit vulnerabilities
6 published CVES affecting open-audit, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 6
- Critical
- 0
- High
- 1
- Medium
- 5
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
Latest open-audit CVEs
Newest publication first
-
-
MediumCVSS 5.4 EPSS 1.1% Public exploit
Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the Admin->Logs section (with a logs?logs.type= URI) and the Manage->Attributes section (...
-
MediumCVSS 6.1 EPSS 0.68%
An issue was discovered in Open-AudIT Professional 2.1. It is possible to inject a malicious payload in the redirect_url parameter to the /login URI to trigger an open redirect. A "data:text/html;base64," payload can be used with JavaScript code.
-
MediumCVSS 5.4 EPSS 0.53%
Open-AudIT Professional 2.1 has XSS via a crafted src attribute of an IMG element within a URI.
-
HighCVSS 8.8 EPSS 1.2%
Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences via the credentials URI.
-
MediumCVSS 5.4 EPSS 1.6%
Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.