CVE-2019-25582 | Medium | 6.5 | 2026-03-21 | i-doit CMDB 1.12 contains an arbitrary file download vulnerability that allows authenticated attackers to download sensitive files by manipulating the file par… |
CVE-2019-25581 | High | 8.2 | 2026-03-21 | i-doit CMDB 1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code thr… |
CVE-2024-8750 | Medium | 5.4 | 2024-09-12 | Cross-site Scripting (XSS) vulnerability in idoit pro version 28. This vulnerability allows an attacker to retrieve session details of an authenticated user du… |
CVE-2024-8749 | High | 8.8 | 2024-09-12 | SQL injection vulnerability in idoit pro version 28. This vulnerability could allow an attacker to send a specially crafted query to the ID parameter in /var/w… |
CVE-2023-46003 | Medium | 5.4 | 2023-10-21 | I-doit pro 25 and below is vulnerable to Cross Site Scripting (XSS) via index.php. |
CVE-2023-37756 | Critical | 9.8 | 2023-09-14 | I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess u… |
CVE-2023-37755 | Critical | 9.8 | 2023-09-14 | i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask u… |
CVE-2023-37739 | Medium | 6.5 | 2023-09-14 | i-doit Pro v25 and below was discovered to be vulnerable to path traversal. |
CVE-2023-34830 | Medium | 5.4 | 2023-06-27 | i-doit Open v24 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the timeout parameter on the login page. |
CVE-2021-3151 | Medium | 5.4 | 2021-02-27 | i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or… |
CVE-2020-13826 | High | 8.8 | 2020-08-20 | A CSV injection (aka Excel Macro Injection or Formula Injection) issue in i-doit 1.14.2 allows an attacker to execute arbitrary commands via a Title parameter… |
CVE-2020-13825 | Medium | 6.1 | 2020-08-20 | A cross-site scripting (XSS) vulnerability in i-doit 1.14.2 allows remote attackers to inject arbitrary web script or HTML via the viewMode, tvMode, tvType, ob… |
CVE-2019-1010248 | Critical | 9.8 | 2019-07-18 | Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection. The impact is: Unauthenticated mysql database access. The component is: Web login form. Th… |
CVE-2019-6965 | Medium | 6.1 | 2019-06-18 | An XSS issue was discovered in i-doit Open 1.12 via the src/tools/php/qr/qr.php url parameter. |
CVE-2018-20159 | High | 7.2 | 2018-12-15 | i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the admini… |
CVE-2014-2231 | | | 2014-02-27 | Cross-site scripting (XSS) vulnerability in the API in synetics i-doit pro before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via a pr… |
CVE-2014-1597 | | | 2014-02-27 | SQL injection vulnerability in the CMDB web application in synetics i-doit pro before 1.2.5 and i-doit open allows remote attackers to execute arbitrary SQL co… |
CVE-2014-1237 | | | 2014-02-11 | Cross-site scripting (XSS) vulnerability in synetics i-doit pro before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the call parame… |
CVE-2013-1413 | | | 2014-02-11 | Multiple cross-site scripting (XSS) vulnerabilities in synetics i-doit open 0.9.9-7, i-doit pro 1.0 and earlier, and i-doit pro 1.0.2 when the 'sanitize user i… |