sapplica records

18 published records for vendor sapplica.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

18 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2018-15873No exploit	A SQL Injection issue was discovered in Sentrifugo 3.2 via the deptid parameter.sapplica · sentrifugo · CWE-89 Pre-auth SQL injection	Critical9.8	—	1.1%	Aug 28, 2018
39Monitor	CVE-2024-29875No exploit	SQL injection vulnerability in Sentrifugosapplica · sentrifugo · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.9%	Mar 21, 2024
39Monitor	CVE-2024-29874No exploit	SQL injection vulnerability in Sentrifugosapplica · sentrifugo · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.9%	Mar 21, 2024
39Monitor	CVE-2024-29871No exploit	SQL injection vulnerability in Sentrifugosapplica · sentrifugo · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.9%	Mar 21, 2024
39Monitor	CVE-2024-29870No exploit	SQL injection vulnerability in Sentrifugosapplica · sentrifugo · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.9%	Mar 21, 2024
39Monitor	CVE-2024-29876No exploit	SQL injection vulnerability in Sentrifugosapplica · sentrifugo · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.8%	Mar 21, 2024
39Monitor	CVE-2024-29872No exploit	SQL injection vulnerability in Sentrifugosapplica · sentrifugo · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.8%	Mar 21, 2024
39Monitor	CVE-2024-29873No exploit	SQL injection vulnerability in Sentrifugosapplica · sentrifugo · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.8%	Mar 21, 2024
35Monitor	CVE-2020-26804No exploit	In Sentrifugo 3.2, users can share an announcement under "Organization -> Announcements" tab.sapplica · sentrifugo · CWE-434 File upload	High8.8	—	1.4%	Nov 12, 2020
35Monitor	CVE-2020-26803No exploit	In Sentrifugo 3.2, users can upload an image under "Assets -> Add" tab.sapplica · sentrifugo · CWE-434 File upload	High8.8	—	1.4%	Nov 12, 2020
35Monitor	CVE-2023-29770No exploit	In Sentrifugo 3.5, the AssetsController::uploadsaveAction function allows an authenticated attacker to upload any file without extension filsapplica · sentrifugo · CWE-434 File upload	High8.8	—	0.9%	Nov 27, 2023
35Monitor	CVE-2019-16059No exploit	Sentrifugo 3.2 lacks CSRF protection.sapplica · sentrifugo · CWE-352 pre-auth RCE CSRF	High8.8	—	0.6%	Sep 6, 2019
28Monitor	CVE-2020-26805No exploit	In Sentrifugo 3.2, admin can edit employee's informations via this endpoint --> /sentrifugo/index.php/empadditionaldetails/edit/userid/2.sapplica · sentrifugo · CWE-89 SQL injection	High7.2	—	1.5%	Nov 12, 2020
26Monitor	CVE-2020-10218No exploit	A Blind SQL Injection issue was discovered in Sapplica Sentrifugo 3.2 via the index.php/holidaygroups/add id parameter because of the Holidasapplica · sentrifugo · CWE-89 SQL injection	Medium6.5	—	1.2%	Mar 13, 2020
24Monitor	CVE-2020-28365No exploit	Sentrifugo 3.2 allows Stored Cross-Site Scripting (XSS) vulnerability by inserting a payload within the X-Forwarded-For HTTP header during tsapplica · sentrifugo · CWE-79 Pre-auth XSS	Medium6.1	—	0.7%	Dec 30, 2020
24Monitor	CVE-2024-29877No exploit	Cross-Site Scripting (XSS) vulnerability in Sentrifugosapplica · sentrifugo · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Mar 21, 2024
24Monitor	CVE-2024-29878No exploit	Cross-Site Scripting (XSS) vulnerability in Sentrifugosapplica · sentrifugo · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Mar 21, 2024
24Monitor	CVE-2024-29879No exploit	Cross-Site Scripting (XSS) vulnerability in Sentrifugosapplica · sentrifugo · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Mar 21, 2024

CVE-2018-15873
39Monitor
A SQL Injection issue was discovered in Sentrifugo 3.2 via the deptid parameter.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
sapplica · sentrifugoAug 28, 2018
CVE-2024-29875
39Monitor
SQL injection vulnerability in Sentrifugo
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
sapplica · sentrifugoMar 21, 2024
CVE-2024-29874
39Monitor
SQL injection vulnerability in Sentrifugo
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
sapplica · sentrifugoMar 21, 2024
CVE-2024-29871
39Monitor
SQL injection vulnerability in Sentrifugo
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
sapplica · sentrifugoMar 21, 2024
CVE-2024-29870
39Monitor
SQL injection vulnerability in Sentrifugo
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
sapplica · sentrifugoMar 21, 2024
CVE-2024-29876
39Monitor
SQL injection vulnerability in Sentrifugo
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
sapplica · sentrifugoMar 21, 2024
CVE-2024-29872
39Monitor
SQL injection vulnerability in Sentrifugo
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
sapplica · sentrifugoMar 21, 2024
CVE-2024-29873
39Monitor
SQL injection vulnerability in Sentrifugo
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
sapplica · sentrifugoMar 21, 2024
CVE-2020-26804
35Monitor
In Sentrifugo 3.2, users can share an announcement under "Organization -> Announcements" tab.
HighCVSS 8.8No exploitEPSS 1%
- File upload
sapplica · sentrifugoNov 12, 2020
CVE-2020-26803
35Monitor
In Sentrifugo 3.2, users can upload an image under "Assets -> Add" tab.
HighCVSS 8.8No exploitEPSS 1%
- File upload
sapplica · sentrifugoNov 12, 2020
CVE-2023-29770
35Monitor
In Sentrifugo 3.5, the AssetsController::uploadsaveAction function allows an authenticated attacker to upload any file without extension fil
HighCVSS 8.8No exploitEPSS 1%
- File upload
sapplica · sentrifugoNov 27, 2023
CVE-2019-16059
35Monitor
Sentrifugo 3.2 lacks CSRF protection.
HighCVSS 8.8No exploitEPSS 1%
- pre-auth RCE
- CSRF
sapplica · sentrifugoSep 6, 2019
CVE-2020-26805
28Monitor
In Sentrifugo 3.2, admin can edit employee's informations via this endpoint --> /sentrifugo/index.php/empadditionaldetails/edit/userid/2.
HighCVSS 7.2No exploitEPSS 2%
- SQL injection
sapplica · sentrifugoNov 12, 2020
CVE-2020-10218
26Monitor
A Blind SQL Injection issue was discovered in Sapplica Sentrifugo 3.2 via the index.php/holidaygroups/add id parameter because of the Holida
MediumCVSS 6.5No exploitEPSS 1%
- SQL injection
sapplica · sentrifugoMar 13, 2020
CVE-2020-28365
24Monitor
Sentrifugo 3.2 allows Stored Cross-Site Scripting (XSS) vulnerability by inserting a payload within the X-Forwarded-For HTTP header during t
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
sapplica · sentrifugoDec 30, 2020
CVE-2024-29877
24Monitor
Cross-Site Scripting (XSS) vulnerability in Sentrifugo
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
sapplica · sentrifugoMar 21, 2024
CVE-2024-29878
24Monitor
Cross-Site Scripting (XSS) vulnerability in Sentrifugo
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
sapplica · sentrifugoMar 21, 2024
CVE-2024-29879
24Monitor
Cross-Site Scripting (XSS) vulnerability in Sentrifugo
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
sapplica · sentrifugoMar 21, 2024