Soplanning
by Soplanning
Source repositories
CVEs (44)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-9266 | Med | 0.42 | 6.5 | 0.01 | Feb 18, 2020 | SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajax_server.php. | ||
| CVE-2024-33722 | Med | 0.41 | 6.3 | 0.00 | May 8, 2026 | SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[]. | ||
| CVE-2024-9573 | Med | 0.41 | 6.3 | 0.00 | Oct 7, 2024 | SQL injection vulnerability in SOPlanning <1.45, through /soplanning/www/groupe_list.php, in the by parameter, which could allow a remote user to send a specially crafted query and extract all the information stored on the server. | ||
| CVE-2024-9572 | Med | 0.41 | 6.3 | 0.00 | Oct 7, 2024 | Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/groupe_save.php, in the groupe_id parameter. This could allow a remote user to send a specially crafted query to an authenticated user and… | ||
| CVE-2024-9571 | Med | 0.41 | 6.3 | 0.00 | Oct 7, 2024 | Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/xajax_server.php, affecting multiple parameters. This could allow a remote user to send a specially crafted query to an authenticated user and… | ||
| CVE-2014-8676 | Med | 0.41 | 5.3 | 0.41 | Aug 31, 2017 | Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) in a URL path parameter. | ||
| CVE-2014-8674 | Med | 0.38 | 5.4 | 0.03 | Jan 6, 2020 | Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_mois and mb_ligness and the debug GET parameter to export.php, which allows malicious users to execute arbitrary code. | ||
| CVE-2014-8677 | Med | 0.38 | 5.3 | 0.03 | Aug 31, 2017 | The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP before 5.2 is being used, the configuration… | ||
| CVE-2024-33724 | Med | 0.35 | 5.4 | 0.01 | May 8, 2026 | SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php. | ||
| CVE-2025-62729 | Med | 0.35 | 5.4 | 0.00 | Nov 20, 2025 | SOPlanning is vulnerable to Stored XSS in /status endpoint. Malicious attacker with an account can inject arbitrary HTML and JS into website, which will be rendered/executed when opening multiple pages. This issue was fixed in version 1.55. | ||
| CVE-2025-62297 | Med | 0.35 | 5.4 | 0.00 | Nov 20, 2025 | SOPlanning is vulnerable to Stored XSS in /projets endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening edited page. This issue was fixed in version 1.55. | ||
| CVE-2025-62296 | Med | 0.35 | 5.4 | 0.00 | Nov 20, 2025 | SOPlanning is vulnerable to Stored XSS in /taches endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor. This issue was fixed in version 1.55. | ||
| CVE-2025-62295 | Med | 0.35 | 5.4 | 0.00 | Nov 20, 2025 | SOPlanning is vulnerable to Stored XSS in /groupe_form endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor. This issue was fixed in version 1.55. | ||
| CVE-2025-62293 | Med | 0.35 | 5.4 | 0.00 | Nov 20, 2025 | SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attacker is able to add, edit and delete any status. This issue was fixed in version 1.55. | ||
| CVE-2025-41001 | Med | 0.35 | 5.4 | 0.00 | Nov 10, 2025 | Cross Site Scripting (XSS) vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'LOGOUT_REDIRECT' parameter in '/soplanning/www/process/options.php'. This vulnerability… | ||
| CVE-2020-25867 | Med | 0.35 | 5.3 | 0.03 | Oct 7, 2020 | SoPlanning before 1.47 doesn't correctly check the security key used to publicly share plannings. It allows a bypass to get access without authentication. | ||
| CVE-2020-15597 | Med | 0.35 | 5.4 | 0.01 | Aug 11, 2020 | SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field. | ||
| CVE-2020-9339 | Med | 0.35 | 5.4 | 0.01 | Feb 22, 2020 | SOPlanning 1.45 allows XSS via the Name or Comment to status.php. | ||
| CVE-2020-9338 | Med | 0.35 | 5.4 | 0.01 | Feb 22, 2020 | SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field. | ||
| CVE-2026-40549 | Med | 0.33 | — | 0.00 | Jun 1, 2026 | SOPlanning is vulnerable to Cross‑Site Request Forgery (CSRF) in groupe_save create, modify and delete endpoints. An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged GET or POST request to the application. This… |
- risk 0.42cvss 6.5epss 0.01
SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajax_server.php.
- risk 0.41cvss 6.3epss 0.00
SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[].
- risk 0.41cvss 6.3epss 0.00
SQL injection vulnerability in SOPlanning <1.45, through /soplanning/www/groupe_list.php, in the by parameter, which could allow a remote user to send a specially crafted query and extract all the information stored on the server.
- risk 0.41cvss 6.3epss 0.00
Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/groupe_save.php, in the groupe_id parameter. This could allow a remote user to send a specially crafted query to an authenticated user and…
- risk 0.41cvss 6.3epss 0.00
Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/xajax_server.php, affecting multiple parameters. This could allow a remote user to send a specially crafted query to an authenticated user and…
- risk 0.41cvss 5.3epss 0.41
Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) in a URL path parameter.
- risk 0.38cvss 5.4epss 0.03
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_mois and mb_ligness and the debug GET parameter to export.php, which allows malicious users to execute arbitrary code.
- risk 0.38cvss 5.3epss 0.03
The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP before 5.2 is being used, the configuration…
- risk 0.35cvss 5.4epss 0.01
SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php.
- risk 0.35cvss 5.4epss 0.00
SOPlanning is vulnerable to Stored XSS in /status endpoint. Malicious attacker with an account can inject arbitrary HTML and JS into website, which will be rendered/executed when opening multiple pages. This issue was fixed in version 1.55.
- risk 0.35cvss 5.4epss 0.00
SOPlanning is vulnerable to Stored XSS in /projets endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening edited page. This issue was fixed in version 1.55.
- risk 0.35cvss 5.4epss 0.00
SOPlanning is vulnerable to Stored XSS in /taches endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor. This issue was fixed in version 1.55.
- risk 0.35cvss 5.4epss 0.00
SOPlanning is vulnerable to Stored XSS in /groupe_form endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor. This issue was fixed in version 1.55.
- risk 0.35cvss 5.4epss 0.00
SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attacker is able to add, edit and delete any status. This issue was fixed in version 1.55.
- risk 0.35cvss 5.4epss 0.00
Cross Site Scripting (XSS) vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'LOGOUT_REDIRECT' parameter in '/soplanning/www/process/options.php'. This vulnerability…
- risk 0.35cvss 5.3epss 0.03
SoPlanning before 1.47 doesn't correctly check the security key used to publicly share plannings. It allows a bypass to get access without authentication.
- risk 0.35cvss 5.4epss 0.01
SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field.
- risk 0.35cvss 5.4epss 0.01
SOPlanning 1.45 allows XSS via the Name or Comment to status.php.
- risk 0.35cvss 5.4epss 0.01
SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field.
- risk 0.33cvss —epss 0.00
SOPlanning is vulnerable to Cross‑Site Request Forgery (CSRF) in groupe_save create, modify and delete endpoints. An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged GET or POST request to the application. This…
Page 2 of 3