Open Web Analytics

3 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2022-24637 PHP CRITICAL POC PATCH THREAT Emergency

Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

PHP Privilege Escalation Open Web Analytics

NVD GitHub Exploit-DB

CVSS 3.1

9.8

EPSS

99.1%

CVE-2014-1456 MEDIUM This Month

Cross-site scripting (XSS) vulnerability in the login page in Open Web Analytics (OWA) before 1.5.6 allows remote attackers to inject arbitrary web script or HTML via the owa_user_id parameter to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.

PHP XSS Open Web Analytics

NVD

CVSS 2.0

4.3

EPSS

0.3%

CVE-2014-1206 HIGH POC This Week

SQL injection vulnerability in the password reset page in Open Web Analytics (OWA) before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the owa_email_address parameter in a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

PHP SQLi Open Web Analytics

NVD Exploit-DB

CVSS 2.0

7.5

EPSS

1.6%

CVE-2022-24637 PHP

EPSS 99% CVSS 9.8

CRITICAL POC PATCH THREAT Emergency

PHP Privilege Escalation Open Web Analytics

NVD GitHub Exploit-DB

CVE-2014-1456

EPSS 0% CVSS 4.3

MEDIUM This Month

PHP XSS Open Web Analytics

NVD

CVE-2014-1206

EPSS 2% CVSS 7.5

HIGH POC This Week

PHP SQLi Open Web Analytics

NVD Exploit-DB