Skip to main content

Jorani CVE-2023-48205

MEDIUM
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
2023-12-07 cve@mitre.org
Information Disclosure Jorani Leave Management System
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Dec 07, 2023 - 07:15 nvd
MEDIUM 5.3

DescriptionNVD

Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emails.

AnalysisAI

Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emails. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-74. Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emails. Affected products include: Jorani Leave Management System.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Jorani

View all
CVE-2023-26469 CRITICAL POC
9.8 Aug 17

In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server. Rated critica
CVE-2022-34132 CRITICAL POC
9.8 Jun 28

Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leav
CVE-2023-45540 MEDIUM POC
6.5 Oct 16

An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted s
CVE-2018-15918 MEDIUM POC
5.4 Sep 05

An issue was discovered in Jorani 0.6.5. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, l
CVE-2018-15917 MEDIUM POC
5.4 Sep 05

Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HT
CVE-2022-34134 HIGH
8.8 Jun 28

Jorani v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /application/controllers/Use
CVE-2023-2681 HIGH
8.8 Oct 03

An SQL Injection vulnerability has been found on Jorani version 1.0.0. Rated high severity (CVSS 8.8), this vulnerabilit
CVE-2025-67102 HIGH
7.6 Feb 17

A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attacker to exec
CVE-2022-34133 MEDIUM
6.1 Jun 28

Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Comment parameter at applicatio

Same weakness CWE-74 – Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2013-2251 CRITICAL POC
9.8
CVE-2022-27924 HIGH POC
7.5
CVE-2016-4010 CRITICAL POC
9.8
CVE-2015-1592 HIGH POC
7.5
CVE-2025-20281 CRITICAL POC
10.0
CVE-2015-7309 MEDIUM POC
6.5
CVE-2014-8423 CRITICAL POC
10.0

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2023-48205 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy