Xclick
Monthly
Insufficient session expiration in bizwell xClick groupware allows authentication bypass through replay of session tokens that should have been invalidated after logout or timeout. Affecting versions R2, R3, and R3.1, the flaw enables an attacker who has obtained a victim's session token to continue using it with full account-level access even after the legitimate session should have ended, carrying high confidentiality, integrity, and availability impact per the CVSS 4.0 score of 8.7. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Stored XSS in bizwell xClick groupware allows authenticated low-privileged users to inject malicious scripts that execute in the browsers of other users who view the affected content. The flaw stems from improper input validation (CWE-20) across xClick releases R2, R3, and R3.1. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is limited by the product's regional deployment footprint.
Insufficient session expiration in bizwell xClick groupware allows authentication bypass through replay of session tokens that should have been invalidated after logout or timeout. Affecting versions R2, R3, and R3.1, the flaw enables an attacker who has obtained a victim's session token to continue using it with full account-level access even after the legitimate session should have ended, carrying high confidentiality, integrity, and availability impact per the CVSS 4.0 score of 8.7. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Stored XSS in bizwell xClick groupware allows authenticated low-privileged users to inject malicious scripts that execute in the browsers of other users who view the affected content. The flaw stems from improper input validation (CWE-20) across xClick releases R2, R3, and R3.1. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is limited by the product's regional deployment footprint.