Jan Syski vulnerabilities
We track 9 vulnerabilities in Jan Syski products across 2 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on May 23, 2025.
Latest Jan Syski vulnerabilities
- 9.1 Critical severity
MegaBIP: Small Space of Random Values
Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with a queryable value. It allows an unauthenticated attacker who know user login names to brute force these tokens and change account passwords
- 8.6 High severity
MegaBIP: Improper Neutralization of Special Elements used in an SQL Command
While editing pages managed by MegaBIP a user with high privileges is prompted to give a reasoning for performing this action. Input provided by the the user is not sanitized, leading to SQL Injection vulnerability. Version 5.20 of MegaBIP fixes this issue.
- 8.7 High severity
MegaBIP: Cross-Site Request Forgery
Websites managed by MegaBIP in versions below 5.15 are vulnerable to Cross-Site Request Forgery (CSRF) as the form available under "/edytor/index.php?id=7,7,0" lacks protection mechanisms. A user could be tricked into visiting a malicious website, which would
- 9.3 Critical severity
MegaBIP: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in parameter "w" in file "druk.php" in MegaBIP software allows unauthorized attacker to disclose the contents of the database and obtain administrator's token to modify the content of pages. This issue affects MegaBIP software versi
- 9.3 Critical severity
MegaBIP: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in MegaBIP software allows attacker to disclose the contents of the database, obtain session cookies or modify the content of pages. This issue affects MegaBIP software versions through 5.12.1.
- 9.8 Critical severity
MegaBIP: Unrestricted Upload of File with Dangerous Type
Arbitrary File Upload vulnerability in MegaBIP software allows attacker to upload any file to the server (including a PHP code file) without an authentication. This issue affects MegaBIP software versions through 5.10.
- 9.8 Critical severity
MegaBIP: Improper Control of Generation of Code
Remote Code Execution vulnerability in MegaBIP software allows to execute arbitrary code on the server without requiring authentication by saving crafted by the attacker PHP code to one of the website files. This issue affects MegaBIP software versions through
- 9.8 Critical severity
MegaBIP: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in MegaBIP software allows attacker to obtain site administrator privileges, including access to the administration panel and the ability to change the administrator password. This issue affects MegaBIP software versions through 5.0
- 8.8 High severity
SmodBIP: Cross-Site Request Forgery
SmodBIP is vulnerable to Cross-Site Request Forgery, that could be used to induce logged in users to perform unintended actions, including creation of additional accounts with administrative privileges. This issue affects all versions of SmodBIP. SmodBIP is no