PRO
by Ultimate Project Manager CRM
CVEs (30)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-4999 | Cri | 0.61 | — | 0.12 | May 16, 2024 | A vulnerability in the web-based management interface of multiple Ligowave devices could allow an authenticated remote attacker to execute arbitrary commands with elevated privileges.This issue affects UNITY: through 6.95-2; PRO: through 6.95-1.Rt3883; MIMO: through… | ||
| CVE-2020-37004 | Hig | 0.53 | 8.2 | 0.00 | Jan 29, 2026 | The Ultimate Project Manager CRM PRO version 2.0.5 contains a blind SQL injection vulnerability that allows attackers to extract usernames and password hashes from the tbl_users database table. Attackers can exploit the /frontend/get_article_suggestion/ endpoint by crafting… | ||
| CVE-2010-5333 | 0.09 | — | 0.16 | Sep 13, 2019 | The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an administration login POST request, leading to arbitrary code execution. An SEH-overwrite buffer overflow already existed for the vulnerable… | |||
| CVE-2024-33752 | 0.07 | — | 0.05 | May 6, 2024 | An arbitrary file upload vulnerability exists in emlog pro 2.3.0 and pro 2.3.2 at admin/views/plugin.php that could be exploited by a remote attacker to submit a special request to upload a malicious file to execute arbitrary code. | |||
| CVE-2019-16702 | 0.05 | — | 0.11 | Sep 23, 2019 | Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs parameter to the /LoginAdmin URI. | |||
| CVE-2003-1481 | 0.03 | — | 0.02 | Dec 31, 2003 | CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers to hijack mail sessions via an e-mail with an IMG tag that references a malicious URL that captures the referer. | |||
| CVE-2002-1911 | 0.03 | — | 0.03 | Dec 31, 2002 | ZoneAlarm Pro 3.0 and 3.1, when configured to block all traffic, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of SYN packets (SYN flood). NOTE: the vendor was not able to reproduce the issue. | |||
| CVE-2023-43291 | 0.01 | — | 0.02 | Sep 26, 2023 | Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code via the cache.php component. | |||
| CVE-2023-37756 | 0.01 | — | 0.01 | Sep 14, 2023 | I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess users' passwords via a bruteforce attack. | |||
| CVE-2025-5119 | 0.00 | — | 0.00 | May 23, 2025 | A vulnerability has been found in Emlog Pro 2.5.11 and classified as critical. This vulnerability affects unknown code of the file /include/controller/api_controller.php. The manipulation of the argument tag leads to sql injection. The attack can be initiated remotely. The… | |||
| CVE-2025-25827 | 0.00 | — | 0.00 | Feb 26, 2025 | A Server-Side Request Forgery (SSRF) in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL. | |||
| CVE-2024-13140 | 0.00 | — | 0.00 | Jan 5, 2025 | A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3. Affected is an unknown function of the file /admin/article.php?action=upload_cover of the component Cover Upload Handler. The manipulation of the argument image leads to cross site scripting. It… | |||
| CVE-2024-12843 | 0.00 | — | 0.00 | Dec 20, 2024 | A vulnerability was found in Emlog Pro up to 2.4.1. It has been rated as problematic. This issue affects some unknown processing of the file /admin/plugin.php. The manipulation of the argument filter leads to cross site scripting. The attack may be initiated remotely. The… | |||
| CVE-2024-3762 | 0.00 | — | 0.00 | Apr 14, 2024 | A vulnerability was found in Emlog Pro 2.2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/twitter.php of the component Whisper Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The… | |||
| CVE-2023-41618 | 0.00 | — | 0.00 | Dec 13, 2023 | Emlog Pro v2.1.14 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin/article.php?active_savedraft. | |||
| CVE-2023-44973 | 0.00 | — | 0.01 | Oct 3, 2023 | An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file. | |||
| CVE-2023-43267 | 0.00 | — | 0.00 | Oct 2, 2023 | A cross-site scripting (XSS) vulnerability in the publish article function of emlog pro v2.1.14 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title field. | |||
| CVE-2023-37755 | 0.00 | — | 0.01 | Sep 14, 2023 | i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain… | |||
| CVE-2022-1526 | 0.00 | — | 0.01 | Apr 29, 2022 | A vulnerability, which was classified as problematic, was found in Emlog Pro up to 1.2.2. This affects the POST parameter handling of articles. The manipulation with the input leads to cross site scripting. It is possible to initiate the attack… | |||
| CVE-2020-13119 | 0.00 | — | 0.01 | Sep 24, 2020 | ismartgate PRO 1.5.9 is vulnerable to clickjacking. |
- risk 0.61cvss —epss 0.12
A vulnerability in the web-based management interface of multiple Ligowave devices could allow an authenticated remote attacker to execute arbitrary commands with elevated privileges.This issue affects UNITY: through 6.95-2; PRO: through 6.95-1.Rt3883; MIMO: through…
- risk 0.53cvss 8.2epss 0.00
The Ultimate Project Manager CRM PRO version 2.0.5 contains a blind SQL injection vulnerability that allows attackers to extract usernames and password hashes from the tbl_users database table. Attackers can exploit the /frontend/get_article_suggestion/ endpoint by crafting…
- CVE-2010-5333Sep 13, 2019risk 0.09cvss —epss 0.16
The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an administration login POST request, leading to arbitrary code execution. An SEH-overwrite buffer overflow already existed for the vulnerable…
- CVE-2024-33752May 6, 2024risk 0.07cvss —epss 0.05
An arbitrary file upload vulnerability exists in emlog pro 2.3.0 and pro 2.3.2 at admin/views/plugin.php that could be exploited by a remote attacker to submit a special request to upload a malicious file to execute arbitrary code.
- CVE-2019-16702Sep 23, 2019risk 0.05cvss —epss 0.11
Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs parameter to the /LoginAdmin URI.
- CVE-2003-1481Dec 31, 2003risk 0.03cvss —epss 0.02
CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers to hijack mail sessions via an e-mail with an IMG tag that references a malicious URL that captures the referer.
- CVE-2002-1911Dec 31, 2002risk 0.03cvss —epss 0.03
ZoneAlarm Pro 3.0 and 3.1, when configured to block all traffic, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of SYN packets (SYN flood). NOTE: the vendor was not able to reproduce the issue.
- CVE-2023-43291Sep 26, 2023risk 0.01cvss —epss 0.02
Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code via the cache.php component.
- CVE-2023-37756Sep 14, 2023risk 0.01cvss —epss 0.01
I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess users' passwords via a bruteforce attack.
- CVE-2025-5119May 23, 2025risk 0.00cvss —epss 0.00
A vulnerability has been found in Emlog Pro 2.5.11 and classified as critical. This vulnerability affects unknown code of the file /include/controller/api_controller.php. The manipulation of the argument tag leads to sql injection. The attack can be initiated remotely. The…
- CVE-2025-25827Feb 26, 2025risk 0.00cvss —epss 0.00
A Server-Side Request Forgery (SSRF) in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL.
- CVE-2024-13140Jan 5, 2025risk 0.00cvss —epss 0.00
A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3. Affected is an unknown function of the file /admin/article.php?action=upload_cover of the component Cover Upload Handler. The manipulation of the argument image leads to cross site scripting. It…
- CVE-2024-12843Dec 20, 2024risk 0.00cvss —epss 0.00
A vulnerability was found in Emlog Pro up to 2.4.1. It has been rated as problematic. This issue affects some unknown processing of the file /admin/plugin.php. The manipulation of the argument filter leads to cross site scripting. The attack may be initiated remotely. The…
- CVE-2024-3762Apr 14, 2024risk 0.00cvss —epss 0.00
A vulnerability was found in Emlog Pro 2.2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/twitter.php of the component Whisper Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The…
- CVE-2023-41618Dec 13, 2023risk 0.00cvss —epss 0.00
Emlog Pro v2.1.14 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin/article.php?active_savedraft.
- CVE-2023-44973Oct 3, 2023risk 0.00cvss —epss 0.01
An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- CVE-2023-43267Oct 2, 2023risk 0.00cvss —epss 0.00
A cross-site scripting (XSS) vulnerability in the publish article function of emlog pro v2.1.14 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title field.
- CVE-2023-37755Sep 14, 2023risk 0.00cvss —epss 0.01
i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain…
- CVE-2022-1526Apr 29, 2022risk 0.00cvss —epss 0.01
A vulnerability, which was classified as problematic, was found in Emlog Pro up to 1.2.2. This affects the POST parameter handling of articles. The manipulation with the input leads to cross site scripting. It is possible to initiate the attack…
- CVE-2020-13119Sep 24, 2020risk 0.00cvss —epss 0.01
ismartgate PRO 1.5.9 is vulnerable to clickjacking.
Page 1 of 2