Plainware vulnerabilities
We track 5 vulnerabilities in Plainware products across 4 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on April 9, 2025.
Latest Plainware vulnerabilities
- 7.1 High severity
PlainInventory: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in plainware PlainInventory z-inventory-manager allows Stored XSS.This issue affects PlainInventory: from n/a through <= 3.1.9.
- 7.1 High severity
PlainInventory: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware PlainInventory z-inventory-manager allows Reflected XSS.This issue affects PlainInventory: from n/a through <= 3.1.5.
- 8.1 High severity
PlainInventory: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in plainware PlainInventory z-inventory-manager allows Object Injection.This issue affects PlainInventory: from n/a through <= 3.1.6.
- 8.1 High severity
Locatoraid Store Locator: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in plainware Locatoraid Store Locator locatoraid allows Object Injection.This issue affects Locatoraid Store Locator: from n/a through <= 3.9.50.
- 7.5 High severity
ShiftController Employee Shift Scheduling: Deserialization of Untrusted Data
The ShiftController Employee Shift Scheduling plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the `hc3_session`-cookie in versions up to, and including, 4.9.57. This makes it possible for an authenticated attacker with c