Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

Export CSV
CVE-2024-8161

SQL injection vulnerability in CIGESv2 system

SQL injection vulnerability in ATISolutions CIGES affecting versions lower than 2.15.5. This vulnerability allows a remote attacker to send a specially crafted SQL query to the /modules/ajaxServiciosCentro.php point in the idCentro parameter and retrieve all the information stored in the database.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ciges
Products
Cigesv2
CVE-2024-2722

SQL injection vulnerability in the CIGESv2 system

SQL injection vulnerability in the CIGESv2 system, through /ajaxConfigTotem.php, in the 'id' parameter. The exploitation of this vulnerability could allow a remote user to retrieve all data stored in the database by sending a specially crafted SQL query.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Atisoluciones Ciges
Products
Ciges Cigesv2
CVE-2024-2723

SQL injection vulnerability in the CIGESv2 system

SQL injection vulnerability in the CIGESv2 system, through /ajaxSubServicios.php, in the 'idServicio' parameter. The exploitation of this vulnerability could allow a remote user to retrieve all data stored in the database by sending a specially crafted SQL query.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Atisoluciones Ciges
Products
Ciges Cigesv2
CVE-2024-2724

SQL injection vulnerability in the CIGESv2 system

SQL injection vulnerability in the CIGESv2 system, through /ajaxServiciosAtencion.php, in the 'idServicio' parameter. The exploitation of this vulnerability could allow a remote user to retrieve all data stored in the database by sending a specially crafted SQL query.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Atisoluciones Ciges
Products
Ciges Cigesv2
CVE-2024-2725

Exposure of Sensitive Information vulnerability in the CIGESv2 system

Information exposure vulnerability in the CIGESv2 system. A remote attacker might be able to access /vendor/composer/installed.json and retrieve all installed packages used by the application.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Atisoluciones Ciges
Products
Ciges Cigesv2
CVE-2024-2726

Stored Cross-Site Scripting (Stored-XSS) vulnerability in the CIGESv2 system

Stored Cross-Site Scripting (Stored-XSS) vulnerability affecting the CIGESv2 system, allowing an attacker to execute and store malicious javascript code in the application form without prior registration.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Atisoluciones Ciges
Products
Ciges Cigesv2
CVE-2024-2727

Stored Cross-Site Scripting (Stored-XSS) vulnerability in the CIGESv2 system

HTML injection vulnerability affecting the CIGESv2 system, which allows an attacker to inject arbitrary code and modify elements of the website and email confirmation message.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Atisoluciones Ciges
Products
Ciges Cigesv2
CVE-2024-2728

Information exposure vulnerability in the CIGESv2 system

Information exposure vulnerability in the CIGESv2 system. This vulnerability could allow a local attacker to intercept traffic due to the lack of proper implementation of the TLS protocol.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Atisoluciones Ciges
Products
Ciges Cigesv2