Gurock develops TestRail, a test-management platform widely used in software development workflows, with its vulnerability footprint concentrated in this single product. The recurring exposure centers on web-application weaknesses—including cross-site scripting, forced browsing, sensitive information disclosure, UI-framing issues, and unsafe file uploads—that are characteristic of browser-facing management interfaces. Public exploit tooling has been developed for vulnerabilities in this vendor's products. Live severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Gurock over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-40875HIGH Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on the client side of a G | Sep 22, 2021 | 7.5 | 70 | NO | YES |
CVE-2018-20063HIGH An issue was discovered in Gurock TestRail 5.6.0.3853. An "Unrestricted Upload of File" vulnerability exists in the image-upload form (available in the description editor), allowin | Feb 25, 2019 | 8.8 | 29 | NO | NO |
CVE-2021-36538MEDIUM Cross Site Scripting (XSS) vulnerability in Gurock TestRail before 7.1.2 allows remote authenticated attackers to run arbitrary code via the reference field in milestones or descri | Feb 3, 2023 | 5.4 | 20 | NO | NO |
CVE-2021-44263MEDIUM Gurock TestRail before 7.2.4 mishandles HTML escaping. | Dec 20, 2021 | 5.4 | 20 | NO | NO |
CVE-2021-37788MEDIUM A vulnerability in the web UI of Gurock TestRail v5.3.0.3603 could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjacking attack. The vuln | Aug 9, 2021 | 5.4 | 19 | NO | NO |
CVE-2019-7535MEDIUM index.php in Gurock TestRail 5.3.0.3603 returns potentially sensitive information for an invalid request, as demonstrated by full path disclosure and the identification of PHP as t | Feb 7, 2019 | 5.3 | 15 | NO | NO |
CVE-2014-4857MEDIUM Cross-site scripting (XSS) vulnerability in Gurock TestRail before 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the Created By field in a project activi | Jul 26, 2014 | 4.3 | 14 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Gurock.
Media articles that mention a CVE ID that affects a product developed by Gurock — matched by CVE ID, not by vendor name.