softwarepublico records
10 published records for vendor softwarepublico.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 1
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')4
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')4
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
- CWE-434 Unrestricted Upload of File with Dangerous Type1
The weakness classes this vendor ships most often: where to look.
CWEAll records
10 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
43Plan | CVE-2022-32409Proof of concept | A local file inclusion (LFI) vulnerability in the component codemirror.php of Portal do Software Publico Brasileiro i3geo v7.0.5 allows attasoftwarepublico · i3geo · CWE-22 | Critical9.8 | — | 13.4% | Jul 14, 2022 |
40Plan | CVE-2017-15379No exploit | An authentication bypass exists in the E-Sic 1.0 /index (aka login) URI via '=''or' values for the username and password.softwarepublico · e-sic · CWE-89 | Critical9.8 | — | 2.7% | Oct 23, 2017 |
40Plan | CVE-2017-15373No exploit | E-Sic 1.0 allows SQL injection via the q parameter to esiclivre/restrito/inc/lkpcep.php (aka the search private area).softwarepublico · e-sic · CWE-89 | Critical9.8 | — | 1.7% | Oct 16, 2017 |
39Monitor | CVE-2017-15381No exploit | SQL Injection exists in E-Sic 1.0 via the f parameter to esiclivre/restrito/inc/buscacep.php (aka the zip code search script).softwarepublico · e-sic · CWE-89 | Critical9.8 | — | 1.5% | Oct 23, 2017 |
35Monitor | CVE-2017-15378No exploit | SQL Injection exists in the E-Sic 1.0 password reset parameter (aka the cpfcnpj parameter to the /reset URI).softwarepublico · e-sic · CWE-89 | High8.8 | — | 1.4% | Oct 23, 2017 |
35Monitor | CVE-2024-24350No exploit | File Upload vulnerability in Software Publico e-Sic Livre v.2.0 and before allows a remote attacker to execute arbitrary code via the extenssoftwarepublico · e-sic livre · CWE-434 | High8.8 | — | 1.2% | Feb 7, 2024 |
25Monitor | CVE-2022-34094Proof of concept | Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via request_token.phsoftwarepublico · i3geo · CWE-79 | Medium6.1 | — | 3.0% | Jul 14, 2022 |
25Monitor | CVE-2022-34093Proof of concept | Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via access_token.phpsoftwarepublico · i3geo · CWE-79 | Medium6.1 | — | 3.0% | Jul 14, 2022 |
24Monitor | CVE-2022-34092No exploit | Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via svg2img.php.softwarepublico · i3geo · CWE-79 | Medium6.1 | — | 1.3% | Jul 14, 2022 |
24Monitor | CVE-2017-15380No exploit | XSS exists in the E-Sic 1.0 /cadastro/index.php URI (aka the requester's registration area) via the nome parameter.softwarepublico · e-sic · CWE-79 | Medium6.1 | — | 0.8% | Oct 23, 2017 |
- CVE-2022-3240943Plan
A local file inclusion (LFI) vulnerability in the component codemirror.php of Portal do Software Publico Brasileiro i3geo v7.0.5 allows atta
CriticalCVSS 9.8Proof of conceptEPSS 13%softwarepublico · i3geoJul 14, 2022
- CVE-2017-1537940Plan
An authentication bypass exists in the E-Sic 1.0 /index (aka login) URI via '=''or' values for the username and password.
CriticalCVSS 9.8No exploitEPSS 3%softwarepublico · e-sicOct 23, 2017
- CVE-2017-1537340Plan
E-Sic 1.0 allows SQL injection via the q parameter to esiclivre/restrito/inc/lkpcep.php (aka the search private area).
CriticalCVSS 9.8No exploitEPSS 2%softwarepublico · e-sicOct 16, 2017
- CVE-2017-1538139Monitor
SQL Injection exists in E-Sic 1.0 via the f parameter to esiclivre/restrito/inc/buscacep.php (aka the zip code search script).
CriticalCVSS 9.8No exploitEPSS 1%softwarepublico · e-sicOct 23, 2017
- CVE-2017-1537835Monitor
SQL Injection exists in the E-Sic 1.0 password reset parameter (aka the cpfcnpj parameter to the /reset URI).
HighCVSS 8.8No exploitEPSS 1%softwarepublico · e-sicOct 23, 2017
- CVE-2024-2435035Monitor
File Upload vulnerability in Software Publico e-Sic Livre v.2.0 and before allows a remote attacker to execute arbitrary code via the extens
HighCVSS 8.8No exploitEPSS 1%softwarepublico · e-sic livreFeb 7, 2024
- CVE-2022-3409425Monitor
Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via request_token.ph
MediumCVSS 6.1Proof of conceptEPSS 3%softwarepublico · i3geoJul 14, 2022
- CVE-2022-3409325Monitor
Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via access_token.php
MediumCVSS 6.1Proof of conceptEPSS 3%softwarepublico · i3geoJul 14, 2022
- CVE-2022-3409224Monitor
Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via svg2img.php.
MediumCVSS 6.1No exploitEPSS 1%softwarepublico · i3geoJul 14, 2022
- CVE-2017-1538024Monitor
XSS exists in the E-Sic 1.0 /cadastro/index.php URI (aka the requester's registration area) via the nome parameter.
MediumCVSS 6.1No exploitEPSS 1%softwarepublico · e-sicOct 23, 2017