Vulnerabilities
4 CVEs · NVD, GitHub Advisories, CISA KEV, FIRST EPSS, GitHub PoC repos
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-50924 | Englesystem is a shift planning system for chaos events. Englesystem is a shift planning system for chaos events. Engelsystem prior to v3.4.1 performed insufficient validation of user supplied data for the DECT number, mobile number, and work-log comment fields. The values of those fields would be displayed in corresponding log overviews, allowing the injection and execution of Javascript code in another user's context. This vulnerability enables an authenticated user to inject Javascript into other user's sessions. The injected JS will be executed during normal usage of the system when viewing, e.g., overview pages. This issue has been fixed in version 3.4.1. NVD description · AI analysis pending | 5.4 | <1% |
| — | ||
| CVE-2023-45659 +1 in the same advisory: …45152 | Engelsystem is a shift planning system for chaos events. Engelsystem is a shift planning system for chaos events. If a users' password is compromised and an attacker gained access to a users' account, i.e., logged in and obtained a session, an attackers' session is not terminated if the users' account password is reset. This vulnerability has been fixed in the commit `dbb089315ff3d`. Users are advised to update their installations. There are no known workarounds for this vulnerability. NVD description · AI analysis pending | 2.8 group max | <1% | PoC |
| — | |
| CVE-2018-19182 | Engelsystem before commit hash 2e28336 allows CSRF. Engelsystem before commit hash 2e28336 allows CSRF. NVD description · AI analysis pending | 8.8 | <1% |
| — |