Itpison Omicard Edm vulnerabilities
9 known vulnerabilities affecting itpison/omicard_edm.
Total CVEs
9
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL4HIGH3MEDIUM2
Vulnerabilities
Page 1 of 1
CVE-2023-48371P2CRITICALCVSS 9.8v6.0.1.52023-12-15
CVE-2023-48371 [CRITICAL] CWE-434 CVE-2023-48371: ITPison OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type.
ITPison OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service.
nvd
CVE-2023-48372P2CRITICALCVSS 9.8v6.0.1.52023-12-15
CVE-2023-48372 [CRITICAL] CWE-89 CVE-2023-48372: ITPison OMICARD EDM 's SMS-related function has insufficient validation for user input. An unauthent
ITPison OMICARD EDM 's SMS-related function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify and delete database.
nvd
CVE-2022-32964P2CRITICALCVSS 9.8≥ 5.8, ≤ 6.02022-08-04
CVE-2022-32964 [CRITICAL] CWE-89 CVE-2022-32964: OMICARD EDM’s API function has insufficient validation for user input. An unauthenticated remote att
OMICARD EDM’s API function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to access, modify, delete database or disrupt service.
nvd
CVE-2022-32965P2CRITICALCVSS 9.8≥ 5.8, ≤ 6.02022-08-04
CVE-2022-32965 [CRITICAL] CWE-798 CVE-2022-32965: OMICARD EDM has a hard-coded machine key. An unauthenticated remote attacker can use the machine key
OMICARD EDM has a hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code, manipulate system data and disrupt service.
nvd
CVE-2023-48373P3HIGHCVSS 7.5v6.0.1.52023-12-15
CVE-2023-48373 [HIGH] CWE-22 CVE-2023-48373: ITPison OMICARD EDM has a path traversal vulnerability within its parameter “FileName” in a specific
ITPison OMICARD EDM has a path traversal vulnerability within its parameter “FileName” in a specific function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files.
nvd
CVE-2022-32963P3HIGHCVSS 7.5≥ 5.8, ≤ 6.02022-08-04
CVE-2022-32963 [HIGH] CWE-22 CVE-2022-32963: OMICARD EDM’s mail file relay function has a path traversal vulnerability. An unauthenticated remote
OMICARD EDM’s mail file relay function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to by-pass authentication and access arbitrary system files.
nvd
CVE-2022-35216P3HIGHCVSS 7.5≥ 5.8, ≤ 6.02022-08-04
CVE-2022-35216 [HIGH] CWE-22 CVE-2022-35216: OMICARD EDM’s mail image relay function has a path traversal vulnerability. An unauthenticated remot
OMICARD EDM’s mail image relay function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to by-pass authentication and access arbitrary system files.
nvd
CVE-2026-10597P4MEDIUMCVSS 5.3≥ 5.8, ≤ 6.0.5.82026-06-04
CVE-2026-10597 [MEDIUM] CWE-639 CVE-2026-10597: OMICARD EDM developed by ITPison has a Insecure Direct Object Reference vulnerability, allowing unau
OMICARD EDM developed by ITPison has a Insecure Direct Object Reference vulnerability, allowing unauthenticated remote attackers to modify a specific parameter to obtain user's email address.
nvd
CVE-2024-4894P4MEDIUMCVSS 5.3≥ earlier, < 6.02024-05-15
CVE-2024-4894 [MEDIUM] CWE-918 CVE-2024-4894: ITPison OMICARD EDM fails to properly filter specific URL parameter, allowing unauthenticated remot
ITPison OMICARD EDM fails to properly filter specific URL parameter, allowing unauthenticated remote attackers to modify the parameters and conduct Server-Side Request Forgery (SSRF) attacks. This vulnerability enables attackers to probe internal network information.
nvd