GCVE - cpe:2.3:a:munkireport_project:munkireport:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:munkireport_project:munkireport:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Munkireport Project (`c242baf6-7b27-5985-b121-67e22d15d644`)
Product	Munkireport (`59432d92-1f0e-597c-8ae2-43b239ef183f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:docker/munkireport/munkireport-php`	purl2cpe	2026-06-01 10:10:57.788718
`pkg:github/munkireport/munkireport-php`	purl2cpe	2026-06-01 10:10:57.788721

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-15884`	vulnerable	2026-06-08 05:19:27.090260	Details available A SQL injection vulnerability in TableQuery.php in MunkiReport before 5.6.3 allows attackers to execute arbitrary SQL commands via the order[0][dir] field on POST requests to /datatables/data. Published: 2020-07-23T13:41:43.000Z Updated: 2024-08-04T13:30:23.297Z Open on db.gcve.eu Reference links https://github.com/munkireport/munkireport-php/releases https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3 https://github.com/munkireport/munkireport-php/wiki/20200722-SQL-Injection-In-Datatables-Order-By-In-Post-Body	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-15882`	vulnerable	2026-06-08 05:19:27.088138	Details available A CSRF issue in manager/delete_machine/{id} in MunkiReport before 5.6.3 allows attackers to delete arbitrary machines from the MunkiReport database. Published: 2020-07-23T13:48:23.000Z Updated: 2024-08-04T13:30:23.197Z Open on db.gcve.eu Reference links https://github.com/munkireport/munkireport-php/releases https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3 https://github.com/munkireport/munkireport-php/wiki/20200722-CSRF-Bypass-On-Endpoints-With-No-Body-Parameters	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-10192`	vulnerable	2026-06-08 05:16:34.847182	Details available An issue was discovered in Munkireport before 5.3.0.3923. An unauthenticated actor can send a custom XSS payload through the /report/broken_client endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/views/listings/default.php. Published: 2020-03-09T18:14:41.000Z Updated: 2024-08-04T10:58:39.077Z Open on db.gcve.eu Reference links https://github.com/munkireport/munkireport-php/releases https://github.com/munkireport/munkireport-php/wiki/20200309-XSS-vulnerability	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-10191`	vulnerable	2026-06-08 05:16:34.846852	Details available An issue was discovered in MunkiReport before 5.3.0. An authenticated actor can send a custom XSS payload through the /module/comment/save endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/controllers/client.php:detail. Published: 2020-03-09T18:18:50.000Z Updated: 2024-08-04T10:58:39.616Z Open on db.gcve.eu Reference links https://github.com/munkireport/munkireport-php/releases https://github.com/munkireport/munkireport-php/wiki/20200309-Authenticated-Comment-XSS	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-10190`	vulnerable	2026-06-08 05:16:34.846434	Details available An issue was discovered in MunkiReport before 5.3.0. An authenticated user could achieve SQL Injection in app/models/tablequery.php by crafting a special payload on the /datatables/data endpoint. Published: 2020-03-09T18:24:48.000Z Updated: 2024-08-04T10:58:39.444Z Open on db.gcve.eu Reference links https://github.com/munkireport/munkireport-php/releases https://github.com/munkireport/munkireport-php/wiki/20200309-Authenticated-SQL-injection	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.