Maggioli vulnerabilities
We track 3 vulnerabilities in Maggioli products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on November 21, 2022.
Latest Maggioli vulnerabilities
- 7.5 High severity
Appalti & Contratti: Improper Control of Filename for Include/Require Statement in PHP Program
An issue was discovered in Appalti & Contratti 9.12.2. The target web applications allow Local File Inclusion in any page relying on the href parameter to specify the JSP page to be rendered. This affects ApriPagina.do POST and GET requests to each application
- 9.8 Critical severity
Appalti & Contratti: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in Appalti & Contratti 9.12.2. The target web applications are subject to multiple SQL Injection vulnerabilities, some of which executable even by unauthenticated users, as demonstrated by the GetListaEnti.do cfamm parameter.
- 8.8 High severity
Appalti & Contratti: Missing Authentication for Critical Functionality
An issue was discovered in Appalti & Contratti 9.12.2. The target web applications LFS and DL229 expose a set of services provided by the Axis 1.4 instance, embedded directly into the applications, as hinted by the WEB-INF/web.xml file leaked through Local Fil