CVE-2026-50644 | | | 2026-07-09 | SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters_all rights can inject SQL commands into the audi… |
CVE-2026-40549 | | | 2026-06-01 | SOPlanning is vulnerable to Cross‑Site Request Forgery (CSRF) in groupe_save create, modify and delete endpoints. An attacker can craft a malicious website tha… |
CVE-2026-40548 | | | 2026-06-01 | SOPlanning does not verify uploaded file extension. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containi… |
CVE-2026-40547 | | | 2026-06-01 | SOPlanning is vulnerable to Path Traversal in backup endpoints. Authenticated remote attacker is able to exploit a vulnerable endpoint and construct payloads… |
CVE-2026-40546 | | | 2026-06-01 | SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters. Attacker with low privileges can inject arbitrary SQL commands, potentially… |
CVE-2026-40545 | | | 2026-06-01 | SOPlanning is vulnerable to Reflected XSS via the taches parameter. An attacker can craft a malicious URL which, when opened by authenticated victim, results i… |
CVE-2026-40544 | | | 2026-06-01 | SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint. An authenticated attacker with access to the backup function… |
CVE-2026-40543 | | | 2026-06-01 | SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve back… |
CVE-2025-62731 | Medium | 4.8 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /feries endpoint. Malicious attacker with access to public holidays feature is able to inject arbitrary HTML and JS i… |
CVE-2025-62730 | High | 8.8 | 2025-11-20 | SOPlanning is vulnerable to Privilege Escalation in user management tab. Users with user_manage_team role are allowed to modify permissions of users. However… |
CVE-2025-62729 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /status endpoint. Malicious attacker with an account can inject arbitrary HTML and JS into website, which will be ren… |
CVE-2025-62297 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /projets endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which wil… |
CVE-2025-62296 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /taches endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will… |
CVE-2025-62295 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /groupe_form endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which… |
CVE-2025-62294 | High | 7.5 | 2025-11-20 | SOPlanning is vulnerable to Predictable Generation of Password Recovery Token. Due to weak mechanism of generating recovery tokens, a malicious attacker is abl… |
CVE-2025-62293 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attack… |
CVE-2025-41001 | Medium | 5.4 | 2025-11-10 | Cross Site Scripting (XSS) vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sendi… |
CVE-2024-57170 | Medium | 6.5 | 2025-03-18 | SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php. The "fichier_to_delete" parameter allows authenticated attackers to spe… |
CVE-2024-57169 | Critical | 9.8 | 2025-03-18 | A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in /process/upload.php. This vulnerability allows remote attackers to bypass uplo… |
CVE-2024-9574 | Critical | 9.8 | 2024-10-07 | SQL injection vulnerability in SOPlanning <1.45, via /soplanning/www/user_groupes.php in the by parameter, which could allow a remote user to submit a speciall… |
CVE-2024-9573 | Medium | 6.3 | 2024-10-07 | SQL injection vulnerability in SOPlanning <1.45, through /soplanning/www/groupe_list.php, in the by parameter, which could allow a remote user to send a specia… |
CVE-2024-9572 | Medium | 6.3 | 2024-10-07 | Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/groupe_save.php, in th… |
CVE-2024-9571 | Medium | 6.3 | 2024-10-07 | Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/xajax_server.php, affe… |
CVE-2024-27115 | Critical | 9.8 | 2024-09-11 | A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. With this vulnerability, an attacker can upload e… |
CVE-2024-27114 | Critical | 9.8 | 2024-09-11 | A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. If the public view setting is enabled, a attacker… |
CVE-2024-27113 | Critical | 9.8 | 2024-09-11 | An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the public view setting is e… |
CVE-2024-27112 | Critical | 9.8 | 2024-09-11 | A unauthenticated SQL Injection has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerab… |
CVE-2020-13963 | Critical | 9.8 | 2021-03-21 | SOPlanning before 1.47 has Incorrect Access Control because certain secret key information, and the related authentication algorithm, is public. The key for ad… |
CVE-2020-25867 | Medium | 5.3 | 2020-10-07 | SoPlanning before 1.47 doesn't correctly check the security key used to publicly share plannings. It allows a bypass to get access without authentication. |
CVE-2020-15597 | Medium | 5.4 | 2020-08-11 | SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field. |
CVE-2020-9339 | Medium | 5.4 | 2020-02-22 | SOPlanning 1.45 allows XSS via the Name or Comment to status.php. |
CVE-2020-9338 | Medium | 5.4 | 2020-02-22 | SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field. |
CVE-2020-9269 | High | 7.2 | 2020-02-18 | SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by export_ical.php. |
CVE-2020-9268 | High | 7.5 | 2020-02-18 | SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nom_createur&by= substring. |
CVE-2020-9267 | Medium | 6.5 | 2020-02-18 | SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajax_server.php. |
CVE-2020-9266 | Medium | 6.5 | 2020-02-18 | SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajax_server.php. |
CVE-2019-20179 | High | 8.8 | 2020-01-09 | SOPlanning 1.45 has SQL injection via the user_list.php "by" parameter. |
CVE-2014-8673 | Critical | 9.8 | 2020-01-07 | Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in Simple Online Planning (SOPPlanning)be… |
CVE-2014-8674 | Medium | 5.4 | 2020-01-06 | Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_mois and mb_ligness… |
CVE-2014-8677 | Medium | 5.3 | 2017-08-31 | The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a… |
CVE-2014-8676 | Medium | 5.3 | 2017-08-31 | Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitr… |
CVE-2014-8675 | High | 7.5 | 2017-08-31 | Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers to obtain a calend… |