| CVE-2020-25867 | 中5.3 | SoPlanning before 1.47 doesn't correctly check the security key used to publicly share plannings. It allows a bypass to get access without authentication. | 07/10/2020 |
| CVE-2020-15597 | 中5.4 | SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field. | 11/08/2020 |
| CVE-2020-9339 | 中5.4 | SOPlanning 1.45 allows XSS via the Name or Comment to status.php. | 22/02/2020 |
| CVE-2020-9338 | 中5.4 | SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field. | 22/02/2020 |
| CVE-2020-9269 | 高7.2 | SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by export_ical.php. | 18/02/2020 |
| CVE-2020-9268 | 高7.5 | SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nom_createur&by= substring. | 18/02/2020 |
| CVE-2020-9267 | 中6.5 | SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajax_server.php. | 18/02/2020 |
| CVE-2020-9266 | 中6.5 | SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajax_server.php. | 18/02/2020 |
| CVE-2019-20179 | 高8.8 | SOPlanning 1.45 has SQL injection via the user_list.php "by" parameter. | 09/01/2020 |
| CVE-2014-8673 | 緊急9.8 | Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in Simple Online Planning (SOPPlanning)before 1.33. | 07/01/2020 |
| CVE-2014-8674 | 中5.4 | Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_mois and mb_ligness and the debug GET parameter to export.php, which allows malicious users to execute arbitrary code. | 06/01/2020 |
| CVE-2014-8677 | 中5.3 | The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP before 5.2 is being used, the configuration database is down, and smarty/templates_c is not | 31/08/2017 |
| CVE-2014-8676 | 中5.3 | Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) in a URL path parameter. | 31/08/2017 |
| CVE-2014-8675 | 高7.5 | Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers to obtain a calendar owner's password via a brute-force attack on the embedded password hash. | 31/08/2017 |