GCVE - cpe:2.3:a:jorani:jorani:1.0.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jorani:jorani:1.0.0:*:*:*:*:*:*:*

part: a version: 1.0.0 update: *

Vendor	Jorani (`4764bf0b-4b77-548c-ba04-8eb0ddacc48c`)
Product	Jorani (`3b8d684e-3f91-598e-a944-34fe51a72994`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/bbalet/jorani`	purl2cpe	2026-06-01 10:18:15.279227
`pkg:sourceforge/jorani`	purl2cpe	2026-06-01 10:18:15.279228

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-53870`	vulnerable	2026-06-08 06:19:39.875523	Jorani 1.0.3 Cross-Site Scripting Vulnerability via Language Parameter Jorani 1.0.3 contains a reflected cross-site scripting vulnerability in the language parameter that allows attackers to inject malicious scripts. Attackers can craft XSS payloads in the language parameter to execute arbitrary JavaScript and potentially steal user session information. Published: 2025-12-15T20:28:14.132Z Updated: 2026-04-07T14:06:57.213Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/51715 https://jorani.org/ https://www.vulncheck.com/advisories/jorani-cross-site-scripting-vulnerability-via-language-parameter	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-2681`	vulnerable	2026-06-08 06:02:42.821020	SQL Injection on Jorani HIGH (8.8) An SQL Injection vulnerability has been found on Jorani version 1.0.0. This vulnerability allows an authenticated remote user, with low privileges, to send queries with malicious SQL code on the "/leaves/validate" path and the “id” parameter, managing to extract arbritary information from the database. Published: 2023-10-03T12:19:55.164Z Updated: 2024-09-19T19:53:17.252Z Open on db.gcve.eu Reference links https://www.incibe.es/en/incibe-cert/notices/aviso/jorani-sql-injection	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-26469`	vulnerable	2026-06-08 05:57:39.766705	Details available In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server. Published: 2023-08-17T00:00:00.000Z Updated: 2024-10-08T16:00:51.499Z Open on db.gcve.eu Reference links https://jorani.org/security-features-in-lms.html https://github.com/Orange-Cyberdefense/CVE-repository/tree/master http://packetstormsecurity.com/files/174248/Jorani-Remote-Code-Execution.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-48118`	vulnerable	2026-06-08 05:50:41.210310	Details available Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter. Published: 2023-01-27T00:00:00.000Z Updated: 2025-03-28T15:45:22.080Z Open on db.gcve.eu Reference links https://github.com/bbalet/jorani/issues/379	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-34134`	vulnerable	2026-06-08 05:44:52.061061	Details available Jorani v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /application/controllers/Users.php. Published: 2022-06-27T23:09:50.000Z Updated: 2026-03-30T14:52:15.103Z Open on db.gcve.eu Reference links https://github.com/bbalet/jorani/issues/369 https://github.com/bbalet/jorani/commit/299b5a3a66add4ac643e3ba78ada4d9637c8baff	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-34133`	vulnerable	2026-06-08 05:44:52.060744	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-34132`	vulnerable	2026-06-08 05:44:52.060350	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.