Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Proliz's OBS: before v3.6.0.
Vendor
Proliz Software Ltd. Co. vulnerabilities
6 published CVES affecting Proliz Software Ltd. Co., from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 6
- Critical
- 2
- High
- 3
- Medium
- 1
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
- OBS 2
- OBS (Student Affairs Information System) 2
- OBS (Student Affairs Information System)0 1
- Proliz's OBS 1
Latest Proliz Software Ltd. Co. CVEs
Newest publication first
-
HighCVSS 7.5 EPSS 0.42%
-
MediumCVSS 6.3 EPSS 0.21%
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Proliz Software Ltd. OBS (Student Affairs Information System)0 allows Reflected XSS. This issue affects OBS (Student Affairs Information System)0: before 26.5009.
-
CVE-2025-11956 XSS in Proliz's OBS
PublishedHighCVSS 8.9 EPSS 0.27%Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Proliz Software Ltd. Co. OBS (Student Affairs Information System) allows Stored XSS. This issue affects OBS (Student Affairs Information System): before 25.0401.
-
HighCVSS 7.6 EPSS 0.26%
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Proliz Software Ltd. Co. OBS (Student Affairs Information System) allows Reflected XSS. This issue affects OBS (Student Affairs Information System): before V26.0401.
-
CriticalCVSS 9.8 EPSS 0.60%
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Proliz Software OBS allows Path Traversal. This issue affects OBS: before 24.0927.
-
CriticalCVSS 9.8 EPSS 0.42%
Authorization Bypass Through User-Controlled Key vulnerability in Proliz Software OBS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects OBS: before 24.0927.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.