Paroiciel vulnerabilities

3 known CVE vulnerabilities in Paroiciel, translated and rated.

CVE-2018-25430High
Paroiciel 11.20 contains an SQL injection vulnerability in the eGeqIdEquipe parameter. Authenticated attackers can send GET requests to egeq.php with crafted SQL payloads to extract sensitive database information, including version details.
CVE-2018-25429High
Paroiciel 11.20 contains an SQL injection vulnerability in the zProIdPro parameter. Authenticated attackers can send GET requests to zpro.php with crafted SQL payloads to extract sensitive database information, including usernames, databases, and version details.
CVE-2018-25428High
SQL Injection vulnerability in Paroiciel 11.20, allowing unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the tRecIdListe parameter. Attackers can send GET requests to trec.php.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS