Phpgacl Project Phpgacl vulnerabilities
7 known vulnerabilities affecting phpgacl_project/phpgacl.
Total CVEs
7
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH2MEDIUM4
Vulnerabilities
Page 1 of 1
CVE-2020-13568P2HIGHCVSS 8.8v3.3.7vOpenEMR 5.0.2, OpenEMR development version 6.0.0 (commit babec93f600ff1394f91ccd512bcad85832eb6ce), phpGACL 3.3.72021-04-13
CVE-2020-13568 [HIGH] CWE-89 CVE-2020-13568: SQL injection vulnerability exists in phpGACL 3.3.7. A specially crafted HTTP request can lead to a
SQL injection vulnerability exists in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability in admin/edit_group.php, when the POST parameter action is “Submit”, the POST parameter parent_id leads to a SQL injection.
nvd
CVE-2020-13567P3CRITICALCVSS 9.8v3.3.72022-04-18
CVE-2020-13567 [CRITICAL] CWE-89 CVE-2020-13567: Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can
Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.
nvd
CVE-2020-13562P3MEDIUMCVSS 6.1v3.3.7vphpGACL 3.3.7 ,OpenEMR 5.0.2 ,OpenEMR development version 6.0.0 (commit babec93f600ff1394f91ccd512bcad85832eb6ce)2021-02-01
CVE-2020-13562 [MEDIUM] CWE-80 CVE-2020-13562: A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specia
A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnaerability in the phpGACL template action parameter.
nvd
CVE-2020-13564P3MEDIUMCVSS 6.1v3.3.7vphpGACL 3.3.72021-02-01
CVE-2020-13564 [MEDIUM] CWE-80 CVE-2020-13564: A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specia
A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnerability in the phpGACL template acl_id parameter.
nvd
CVE-2020-13563P3MEDIUMCVSS 6.1v3.3.7vphpGACL 3.3.7 , OpenEMR 5.0.2 , OpenEMR development version 6.0.0 (commit babec93f600ff1394f91ccd512bcad85832eb6ce)2021-02-01
CVE-2020-13563 [MEDIUM] CWE-80 CVE-2020-13563: A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specia
A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnerability in the phpGACL template group_id parameter.
nvd
CVE-2020-13566P3HIGHCVSS 8.8v3.3.7vphpGACL 3.3.72021-04-13
CVE-2020-13566 [HIGH] CWE-89 CVE-2020-13566: SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a
SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability In admin/edit_group.php, when the POST parameter action is “Delete”, the POST parameter delete_group leads to a SQL injection.
nvd
CVE-2020-13565P4MEDIUMCVSS 6.1v3.3.7vOpenEMR 5.0.2,OpenEMR development version 6.0.0 (commit babec93f600ff1394f91ccd512bcad85832eb6ce),phpGACL 3.3.72021-02-10
CVE-2020-13565 [MEDIUM] CWE-601 CVE-2020-13565: An open redirect vulnerability exists in the return_page redirection functionality of phpGACL 3.3.7,
An open redirect vulnerability exists in the return_page redirection functionality of phpGACL 3.3.7, OpenEMR 5.0.2 and OpenEMR development version 6.0.0 (commit babec93f600ff1394f91ccd512bcad85832eb6ce). A specially crafted HTTP request can redirect users to an arbitrary URL. An attacker can provide a crafted URL to trigger this vulnerability.
nvd