Known vulnerabilities in TestLink

Vendor: testlink.org
Software: TestLink
Software CPE: cpe:2.3:a:testlink.org:testlink:*:*:*:*:*:*:*:*
Website: https://www.testlink.org/
Total vulnerabilities: 15
Public exploits: 5
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting TestLink TestLink is affected by 15 known vulnerabilities: 5 high, 5 medium, 5 low Critical High Medium Low

Vulnerabilities (15)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU58828 - Exposure of sensitive information to an unauthorized actor
 CWE-200 Medium
No
No
 1.9.20 10.12.2021 SB2021121012
#VU34422 - Insufficiently Protected Credentials
CVE-2020-12273		 CWE-522 Medium
No
No
 - 27.04.2020 SB2020040329
#VU34423 - Improper input validation
CVE-2020-12274		 CWE-20 High
No
No
 - 27.04.2020 SB2020040329
#VU34599 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2020-8637		 CWE-89 High
No
No
 - 03.04.2020 SB2020040329
#VU34600 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2020-8638		 CWE-89 High
Available
No
 - 03.04.2020 SB2020040329
#VU34601 - Unrestricted Upload of File with Dangerous Type
CVE-2020-8639		 CWE-434 High
Available
No
 - 03.04.2020 SB2020040329
#VU25844 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2020-8841		 CWE-89 Medium
No
No
 1.9.20 10.03.2020 SB2020031001
#VU25842 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2019-20107		 CWE-89 High
No
No
 1.9.20 05.03.2020 SB2020031001
#VU24458 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-14471		 CWE-79 Low
No
No
 1.9.20 21.01.2020 SB2020012106
#VU24457 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-20381		 CWE-79 Low
No
No
 1.9.20 21.01.2020 SB2020012106
#VU24456 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-19491		 CWE-79 Low
No
No
 1.9.20 21.01.2020 SB2020012106
#VU41233 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2014-5308		 CWE-89 Medium
Available
No
 - 08.10.2014 SB2014100806
#VU41402 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2012-0938		 CWE-89 Low
Available
No
 - 14.08.2014 SB2014081402
#VU41403 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2012-0939		 CWE-89 Low
No
No
 - 14.08.2014 SB2014081402
#VU43512 - Cross-Site Request Forgery (CSRF)
CVE-2012-2275		 CWE-352 Medium
Available
No
 - 15.09.2012 SB2012091501