Skip to content
Noroxi

SOPlanning records

34 published records for vendor soplanning.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
2
With a fix record
23.5%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 20
  3. 21
  4. 24
  5. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

34 records
  • CVE-2014-8673
    43Plan

    Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in Simple Online Plann

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    soplanning · soplanningJan 7, 2020

  • CVE-2024-27115
    41Plan

    Remote Code Execution through File Upload in SOPlanning before 1.52.02

    CriticalCVSS 10.0Proof of conceptEPSS 4%

    soplanning · soplanningSep 11, 2024

  • CVE-2020-13963
    40Plan

    SOPlanning before 1.47 has Incorrect Access Control because certain secret key information, and the related authentication algorithm, is pub

    CriticalCVSS 9.8No exploitEPSS 1%

    soplanning · soplanningMar 21, 2021

  • CVE-2024-57169
    39Monitor

    A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in /process/upload.php.

    CriticalCVSS 9.8No exploitEPSS 0%

    soplanning · soplanningMar 18, 2025

  • CVE-2024-27113
    37Monitor

    Insecure Direct Object Reference to export Database in SOPlanning before 1.52.02

    CriticalCVSS 9.3No exploitEPSS 0%

    soplanning · soplanningSep 11, 2024

  • CVE-2024-27112
    37Monitor

    SQL Injection in SOPlanning before 1.52.02

    CriticalCVSS 9.3No exploitEPSS 0%

    soplanning · soplanningSep 11, 2024

  • CVE-2019-20179
    35Monitor

    SOPlanning 1.45 has SQL injection via the user_list.php "by" parameter.

    HighCVSS 8.8No exploitEPSS 1%

    soplanning · soplanningJan 9, 2020

  • CVE-2024-27114
    35Monitor

    Remote Code Execution through File Upload in SOPlanning before 1.52.02

    HighCVSS 8.9No exploitEPSS 0%

    soplanning · soplanningSep 11, 2024

  • CVE-2014-8675
    34Monitor

    Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers

    HighCVSS 7.5Proof of conceptEPSS 12%

    soplanning · soplanningAug 31, 2017

  • CVE-2025-62294
    34Monitor

    Predictable Generation of Password Recovery Token

    HighCVSS 8.7No exploitEPSS 0%

    soplanning · soplanningNov 20, 2025

  • CVE-2025-62730
    34Monitor

    Privilege Escalation via Incorrect Authorization in SOPlanning

    HighCVSS 8.7No exploitEPSS 0%

    soplanning · soplanningNov 20, 2025

  • CVE-2014-8676
    33Monitor

    Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the

    MediumCVSS 5.3Proof of conceptEPSS 39%

    soplanning · soplanningAug 31, 2017

  • CVE-2020-9268
    30Monitor

    SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nom_createur&by= substring.

    HighCVSS 7.5No exploitEPSS 1%

    soplanning · soplanningFeb 18, 2020

  • CVE-2020-9269
    29Monitor

    SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by exp

    HighCVSS 7.2No exploitEPSS 2%

    soplanning · soplanningFeb 18, 2020

  • CVE-2024-57170
    26Monitor

    SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php.

    MediumCVSS 6.5No exploitEPSS 0%

    soplanning · soplanningMar 18, 2025

  • CVE-2024-9574
    26Monitor

    SQL Injection vulnerability in SOPlanning

    MediumCVSS 6.5No exploitEPSS 0%

    soplanning · soplanningOct 7, 2024

  • CVE-2020-9266
    26Monitor

    SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajax_server.php.

    MediumCVSS 6.5No exploitEPSS 0%

    soplanning · soplanningFeb 18, 2020

  • CVE-2020-9267
    26Monitor

    SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajax_server.php.

    MediumCVSS 6.5No exploitEPSS 0%

    soplanning · soplanningFeb 18, 2020

  • CVE-2024-9573
    26Monitor

    SQL Injection vulnerability in SOPlanning

    MediumCVSS 6.5No exploitEPSS 0%

    soplanning · soplanningOct 7, 2024

  • CVE-2014-8677
    22Monitor

    The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existi

    MediumCVSS 5.3Proof of conceptEPSS 3%

    soplanning · soplanningAug 31, 2017

  • CVE-2020-25867
    22Monitor

    SoPlanning before 1.47 doesn't correctly check the security key used to publicly share plannings.

    MediumCVSS 5.3Proof of conceptEPSS 2%

    soplanning · soplanningOct 7, 2020

  • CVE-2014-8674
    22Monitor

    Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_m

    MediumCVSS 5.4Proof of conceptEPSS 2%

    soplanning · soplanningJan 6, 2020

  • CVE-2020-9339
    21Monitor

    SOPlanning 1.45 allows XSS via the Name or Comment to status.php.

    MediumCVSS 5.4No exploitEPSS 0%

    soplanning · soplanningFeb 22, 2020

  • CVE-2020-15597
    21Monitor

    SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field.

    MediumCVSS 5.4No exploitEPSS 0%

    soplanning · soplanningAug 11, 2020

  • CVE-2020-9338
    21Monitor

    SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field.

    MediumCVSS 5.4No exploitEPSS 0%

    soplanning · soplanningFeb 22, 2020