GCVE - cpe:2.3:a:i-doit:i-doit:*:*:*:*:open:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:i-doit:i-doit:*:*:*:*:open:*:*:*

part: a version: * update: *

Vendor	I Doit (`065340d3-6a29-57a6-8bff-2c13a60343c0`)
Product	I Doit (`05324411-e879-5ce1-8f9e-da25d6822bc7`)
Edition	*
Language	*
Software edition	open
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-37756`	vulnerable	2026-06-08 06:08:15.948878	Details available I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess users' passwords via a bruteforce attack. Published: 2023-09-14T00:00:00.000Z Updated: 2024-09-25T20:32:17.872Z Open on db.gcve.eu Reference links https://github.com/leekenghwa/CVE-2023-37756-CWE-521-lead-to-malicious-plugin-upload-in-the-i-doit-Pro-25-and-below/blob/main/README.md https://medium.com/%40ray.999/idoit-pro-v25-and-below-weak-password-add-on-upload-to-rce-cve-2023-37756-fa1b18433ca3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-37755`	vulnerable	2026-06-08 06:08:15.948326	Details available i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator privileges, resulting in them being able to perform arbitrary system operations or cause a Denial of Service (DoS). Published: 2023-09-14T00:00:00.000Z Updated: 2024-09-26T13:44:54.781Z Open on db.gcve.eu Reference links https://github.com/leekenghwa/CVE-2023-37755---Hardcoded-Admin-Credential-in-i-doit-Pro-25-and-below/blob/main/README.md https://medium.com/%40ray.999/d7a54030e055 https://medium.com/%40ray.999/i-doit-v25-and-below-incorrect-access-control-issue-cve-2023-37755-d7a54030e055	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-34830`	vulnerable	2026-06-08 06:06:25.922851	Details available i-doit Open v24 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the timeout parameter on the login page. Published: 2023-06-27T00:00:00.000Z Updated: 2024-12-05T19:09:46.933Z Open on db.gcve.eu Reference links https://medium.com/%40ray.999/cve-2023-34830-reflected-xss-on-i-doit-open-v24-and-below-ad58036f5407 https://github.com/leekenghwa/CVE-2023-34830---Reflected-XSS-found-in-I-doit-Open-v24-and-below	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.