Isic.lk vulnerabilities

3 known vulnerabilities in Isic.lk from Isic.lk Project. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Isic.lk: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2022-30528Dec 1, 2022Isic.lk ProjectEPSS 1.26%

  SQL Injection vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to execute arbitrary commands via the username parameter to /system/user/modules/mod_users/controller.php.

• 7.5 High severity

  Isic.lk: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2022-28607Dec 1, 2022Isic.lk Project

  An issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to gain sensitive information via the action parameter to /system/user/modules/mod_users/controller.php.

• 7.2 High severity

  Isic.lk: Unrestricted Upload of File with Dangerous Type

  CVE-2022-30529Nov 22, 2022Isic.lk ProjectEPSS 1.02%

  File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary files via /system/application/libs/js/tinymce/plugins/filemanager/dialog.php and /system/application/libs/js/tinymce/pl