Rukovoditel 2.7.2

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:rukovoditel:rukovoditel:2.7.2:*:*:*:*:*:*:*

part: a version: 2.7.2 update: *

VendorRukovoditel (43cc348a-3cf0-589d-a12c-52976d3ecadc)
ProductRukovoditel (af15ae84-bbc3-5b06-ab63-db60a3460443)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:docker/filipmil/rukovoditel purl2cpe 2026-06-01 10:13:47.284458
pkg:github/rukovoditel/rukovoditel purl2cpe 2026-06-01 10:13:47.284460
pkg:sourceforge/rukovoditel purl2cpe 2026-06-01 10:13:47.284462

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2020-35987 vulnerable 2026-06-08 05:25:02.402332 Details available
A stored cross site scripting (XSS) vulnerability in the 'Entities List' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.
Published: 2021-07-09T21:55:51.000Z
Updated: 2024-08-04T17:16:13.705Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-35986 vulnerable 2026-06-08 05:25:02.401947 Details available
A stored cross site scripting (XSS) vulnerability in the 'Users Access Groups' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.
Published: 2021-07-09T21:55:52.000Z
Updated: 2024-08-04T17:16:13.909Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-35985 vulnerable 2026-06-08 05:25:02.401644 Details available
A stored cross site scripting (XSS) vulnerability in the 'Global Lists" feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.
Published: 2021-07-09T21:55:54.000Z
Updated: 2024-08-04T17:16:13.486Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-35984 vulnerable 2026-06-08 05:25:02.401055 Details available
A stored cross site scripting (XSS) vulnerability in the 'Users Alerts' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' parameter.
Published: 2021-07-09T21:55:55.000Z
Updated: 2024-08-04T17:16:13.474Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-13592 vulnerable 2026-06-08 05:18:00.832047 Details available
MEDIUM (5.4)
An exploitable SQL injection vulnerability exists in "global_lists/choices" page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability, this can be done either with administrator credentials or through cross-site request forgery.
Published: 2021-04-09T17:48:02.000Z
Updated: 2024-08-04T12:25:16.142Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-13591 vulnerable 2026-06-08 05:18:00.831578 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-13590 vulnerable 2026-06-08 05:18:00.831142 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-13589 vulnerable 2026-06-08 05:18:00.829216 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-13588 vulnerable 2026-06-08 05:18:00.828729 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-13587 vulnerable 2026-06-08 05:18:00.828266 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.