Approved changes feed: RSS · Atom
cpe:2.3:a:jorani:jorani:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Jorani (4764bf0b-4b77-548c-ba04-8eb0ddacc48c) |
|---|---|
| Product | Jorani (3b8d684e-3f91-598e-a944-34fe51a72994) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/bbalet/jorani |
purl2cpe | 2026-06-01 10:18:15.279142 |
pkg:sourceforge/jorani |
purl2cpe | 2026-06-01 10:18:15.279146 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-67102 |
vulnerable | 2026-06-08 07:41:19.703264 |
Details available
A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attacker to execute arbitrary SQL commands via the entity parameter.
Published: 2026-02-17T00:00:00.000Z
Updated: 2026-03-11T15:19:31.147Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-53870 |
vulnerable | 2026-06-08 06:19:39.872768 |
Jorani 1.0.3 Cross-Site Scripting Vulnerability via Language Parameter
Jorani 1.0.3 contains a reflected cross-site scripting vulnerability in the language parameter that allows attackers to inject malicious scripts. Attackers can craft XSS payloads in the language parameter to execute arbitrary JavaScript and potentially steal user session information.
Published: 2025-12-15T20:28:14.132Z
Updated: 2026-04-07T14:06:57.213Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-2681 |
vulnerable | 2026-06-08 06:02:42.820118 |
SQL Injection on Jorani
HIGH (8.8)
An SQL Injection vulnerability has been found on Jorani version 1.0.0. This vulnerability allows an authenticated remote user, with low privileges, to send queries with malicious SQL code on the "/leaves/validate" path and the “id” parameter, managing to extract arbritary information from the database.
Published: 2023-10-03T12:19:55.164Z
Updated: 2024-09-19T19:53:17.252Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.