Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2026-10597

ITPison｜OMICARD EDM - Insecure Direct Object Reference

OMICARD EDM developed by ITPison has a Insecure Direct Object Reference vulnerability, allowing unauthenticated remote attackers to modify a specific parameter to obtain user's email address.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Itpison
Products
Omicard Edm
CVE-2024-4894

ITPison OMICARD EDM - Server-Side Request Forgery

ITPison OMICARD EDM fails to properly filter specific URL parameter, allowing unauthenticated remote attackers to modify the parameters and conduct Server-Side Request Forgery (SSRF) attacks. This vulnerability enables attackers to probe internal network information.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Itpison
Products
Omicard Edm
CVE-2023-48373

ITPison OMICARD EDM 's SMS - Path Traversal

ITPison OMICARD EDM has a path traversal vulnerability within its parameter “FileName” in a specific function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Itpison
Products
Omicard Edm
CVE-2023-28700

ITPison OMICARD EDM - Arbitrary File Upload

OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type. A local area network attacker with administrator privileges can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Itpison
Products
Omicard Edm
CVE-2023-32753

ITPison OMICARD EDM - Arbitrary File Upload

OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Itpison
Products
Omicard Edm
CVE-2023-48372

ITPison OMICARD EDM 's SMS - SQL Injection

ITPison OMICARD EDM 's SMS-related function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify and delete database.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Itpison
Products
Omicard Edm
CVE-2023-48371

ITPison OMICARD EDM 's SMS - Arbitrary File Upload

ITPison OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Itpison
Products
Omicard Edm