Jorani

10 CVEs across 2 Jorani products. Browse Jorani vulnerabilities, severities, and proof-of-concept exploits.

Jorani products with known CVEs

ProductCVEs
Jorani8
Leave Management System2
Jorani CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-67102High7.62026-02-17A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attacker to execute arbitrary SQL commands via the enti…
CVE-2023-538702025-12-15Jorani 1.0.3 contains a reflected cross-site scripting vulnerability in the language parameter that allows attackers to inject malicious scripts. Attackers can…
CVE-2023-48205Medium5.32023-12-07Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emails.
CVE-2023-45540Medium6.52023-10-16An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List…
CVE-2023-2681High8.82023-10-03An SQL Injection vulnerability has been found on Jorani version 1.0.0. This vulnerability allows an authenticated remote user, with low privileges, to send que…
CVE-2023-26469Critical9.82023-08-17In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.
CVE-2022-48118Medium6.12023-01-27Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter.
CVE-2022-34134High8.82022-06-28Jorani v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /application/controllers/Users.php.
CVE-2022-34133Medium6.12022-06-28Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Comment parameter at application/controllers/Leaves.php.
CVE-2022-34132Critical9.82022-06-28Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php.