Esoftplanner develops a project-planning application that despite modest disclosure volume occupies a noteworthy position in vulnerability tracking, likely reflecting its deployment across planning-dependent workflows. The recurring weaknesses concentrate in web-facing input handling and resource management: cross-site scripting flaws in web page generation, resource exhaustion through unbounded allocation, and insecure default permissions represent the durable signature of this vendor's exposure. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Esoftplanner over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-48536HIGH Incorrect access control in eSoft Planner 3.24.08271-USA allow attackers to view all transactions performed by the company via supplying a crafted web request. | Nov 20, 2024 | 7.5 | 20 | NO | NO |
CVE-2024-48530HIGH An issue in the Instructor Appointment Availability module of eSoft Planner 3.24.08271-USA allows attackers to cause a Denial of Service (DoS) via a crafted POST request. | Nov 20, 2024 | 7.5 | 20 | NO | NO |
CVE-2024-48535MEDIUM A stored cross-site scripting (XSS) vulnerability in eSoft Planner 3.24.08271-USA allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the | Nov 20, 2024 | 5.4 | 16 | NO | NO |
CVE-2024-48534MEDIUM A reflected cross-site scripting (XSS) vulnerability on the Camp Details module of eSoft Planner 3.24.08271-USA allows attackers to execute arbitrary code in the context of a user' | Nov 20, 2024 | 5.4 | 16 | NO | NO |
CVE-2024-48533MEDIUM A discrepancy between responses for valid and invalid e-mail accounts in the Forgot your Login? module of eSoft Planner 3.24.08271-USA allows attackers to enumerate valid user e-ma | Nov 20, 2024 | 5.3 | 16 | NO | NO |
CVE-2024-48531MEDIUM A reflected cross-site scripting (XSS) vulnerability on the Rental Availability module of eSoft Planner 3.24.08271-USA allows attackers to execute arbitrary code in the context of | Nov 20, 2024 | 5.4 | 16 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Esoftplanner.
Media articles that mention a CVE ID that affects a product developed by Esoftplanner — matched by CVE ID, not by vendor name.