I Librarian
by Mkucej
Source repositories
CVEs (10)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-50344 | Med | 0.23 | 4.6 | 0.00 | Oct 30, 2024 | I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIME type. Unfortunately, this logic is broken, thus allowing unsafe files containing Javascript to be executed with the application context. An attacker can exploit this vulnerability by uploading a supplementary file that contains a malicious code or script. This code will then be executed when the file is loaded in the browser. The vulnerability was fixed in version 5.11.2. | ||
| CVE-2024-40500 | 0.00 | — | 0.02 | Aug 12, 2024 | Cross Site Scripting vulnerability in Martin Kucej i-librarian v.5.11.0 and before allows a local attacker to execute arbitrary code via the search function in the import component. | |||
| CVE-2019-11449 | 0.00 | — | 0.00 | Apr 22, 2019 | I, Librarian 4.10 has XSS via the notes.php notes parameter. | |||
| CVE-2019-11428 | 0.00 | — | 0.00 | Apr 21, 2019 | I, Librarian 4.10 has XSS via the export.php export_files parameter. | |||
| CVE-2019-11359 | 0.00 | — | 0.00 | Apr 19, 2019 | Cross-site scripting (XSS) vulnerability in display.php in I, Librarian 4.10 allows remote attackers to inject arbitrary web script or HTML via the project parameter. | |||
| CVE-2018-1000139 | 0.00 | — | 0.00 | Mar 23, 2018 | I, Librarian version 4.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in "id" parameter in stable.php that can result in an attacker using the XSS to send a malicious script to an unsuspecting user. | |||
| CVE-2018-1000141 | 0.00 | — | 0.00 | Mar 23, 2018 | I, Librarian version 4.9 and earlier contains an Incorrect Access Control vulnerability in ajaxdiscussion.php that can result in any users gaining unauthorized access (read, write and delete) to project discussions. | |||
| CVE-2018-1000137 | 0.00 | — | 0.00 | Mar 23, 2018 | I, Librarian version 4.8 and earlier contains a Cross site Request Forgery (CSRF) vulnerability in users.php that can result in the password of the admin being forced to be changed without the administrator's knowledge. | |||
| CVE-2018-1000138 | 0.00 | — | 0.00 | Mar 23, 2018 | I, Librarian version 4.8 and earlier contains a SSRF vulnerability in "url" parameter of getFromWeb in functions.php that can result in the attacker abusing functionality on the server to read or update internal resources. | |||
| CVE-2018-1000124 | 0.00 | — | 0.00 | Mar 13, 2018 | I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in line 154 of importmetadata.php(simplexml_load_string) that can result in an attacker reading the contents of a file and SSRF. This attack appear to be exploitable via posting xml in the Parameter form_import_textarea. |
- risk 0.23cvss 4.6epss 0.00
I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIME type. Unfortunately, this logic is broken, thus allowing unsafe files containing Javascript to be executed with the application context. An attacker can exploit this vulnerability by uploading a supplementary file that contains a malicious code or script. This code will then be executed when the file is loaded in the browser. The vulnerability was fixed in version 5.11.2.
- CVE-2024-40500Aug 12, 2024risk 0.00cvss —epss 0.02
Cross Site Scripting vulnerability in Martin Kucej i-librarian v.5.11.0 and before allows a local attacker to execute arbitrary code via the search function in the import component.
- CVE-2019-11449Apr 22, 2019risk 0.00cvss —epss 0.00
I, Librarian 4.10 has XSS via the notes.php notes parameter.
- CVE-2019-11428Apr 21, 2019risk 0.00cvss —epss 0.00
I, Librarian 4.10 has XSS via the export.php export_files parameter.
- CVE-2019-11359Apr 19, 2019risk 0.00cvss —epss 0.00
Cross-site scripting (XSS) vulnerability in display.php in I, Librarian 4.10 allows remote attackers to inject arbitrary web script or HTML via the project parameter.
- CVE-2018-1000139Mar 23, 2018risk 0.00cvss —epss 0.00
I, Librarian version 4.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in "id" parameter in stable.php that can result in an attacker using the XSS to send a malicious script to an unsuspecting user.
- CVE-2018-1000141Mar 23, 2018risk 0.00cvss —epss 0.00
I, Librarian version 4.9 and earlier contains an Incorrect Access Control vulnerability in ajaxdiscussion.php that can result in any users gaining unauthorized access (read, write and delete) to project discussions.
- CVE-2018-1000137Mar 23, 2018risk 0.00cvss —epss 0.00
I, Librarian version 4.8 and earlier contains a Cross site Request Forgery (CSRF) vulnerability in users.php that can result in the password of the admin being forced to be changed without the administrator's knowledge.
- CVE-2018-1000138Mar 23, 2018risk 0.00cvss —epss 0.00
I, Librarian version 4.8 and earlier contains a SSRF vulnerability in "url" parameter of getFromWeb in functions.php that can result in the attacker abusing functionality on the server to read or update internal resources.
- CVE-2018-1000124Mar 13, 2018risk 0.00cvss —epss 0.00
I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in line 154 of importmetadata.php(simplexml_load_string) that can result in an attacker reading the contents of a file and SSRF. This attack appear to be exploitable via posting xml in the Parameter form_import_textarea.