Isic.lk Project vulnerabilities
We track 3 vulnerabilities in Isic.lk Project products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on December 1, 2022.
Latest Isic.lk Project vulnerabilities
- 9.8 Critical severity
Isic.lk: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to execute arbitrary commands via the username parameter to /system/user/modules/mod_users/controller.php.
- 7.5 High severity
Isic.lk: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to gain sensitive information via the action parameter to /system/user/modules/mod_users/controller.php.
- 7.2 High severity
Isic.lk: Unrestricted Upload of File with Dangerous Type
File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary files via /system/application/libs/js/tinymce/plugins/filemanager/dialog.php and /system/application/libs/js/tinymce/pl