Testrail
Vendor:
First CVE: Jul 26, 2014 · Active for 12 years
7
Total CVEs
More Total CVEs than 85% of tracked products
1.8
Avg CVEs / Year
Higher CVE frequency than 63% of tracked products
6.0
Avg CVSS
Higher Avg CVSS than 24% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Testrail over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jul 26, 2014
12 years ago
Most Recent CVE
Feb 3, 2023
1,271 days ago
CVE Severity & Scoring
Testrail7 CVEs
71%
29%
All CVEs352,785 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network6 (85.7%)
Unknown1 (14.3%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low6 (85.7%)
High0 (0.0%)
Unknown1 (14.3%)
User Interaction
None3 (42.9%)
Unknown1 (14.3%)
Required3 (42.9%)
Privileges Required
Low3 (42.9%)
High0 (0.0%)
None3 (42.9%)
Unknown1 (14.3%)
Top CVEs
Signals from CVEs in this product scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-40875HIGH Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on the client side of a G | Sep 22, 2021 | 7.5 | 70 | NO | YES |
CVE-2018-20063HIGH An issue was discovered in Gurock TestRail 5.6.0.3853. An "Unrestricted Upload of File" vulnerability exists in the image-upload form (available in the description editor), allowin | Feb 25, 2019 | 8.8 | 29 | NO | NO |
CVE-2021-36538MEDIUM Cross Site Scripting (XSS) vulnerability in Gurock TestRail before 7.1.2 allows remote authenticated attackers to run arbitrary code via the reference field in milestones or descri | Feb 3, 2023 | 5.4 | 20 | NO | NO |
CVE-2021-44263MEDIUM Gurock TestRail before 7.2.4 mishandles HTML escaping. | Dec 20, 2021 | 5.4 | 20 | NO | NO |
CVE-2021-37788MEDIUM A vulnerability in the web UI of Gurock TestRail v5.3.0.3603 could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjacking attack. The vuln | Aug 9, 2021 | 5.4 | 19 | NO | NO |
CVE-2019-7535MEDIUM index.php in Gurock TestRail 5.3.0.3603 returns potentially sensitive information for an invalid request, as demonstrated by full path disclosure and the identification of PHP as t | Feb 7, 2019 | 5.3 | 15 | NO | NO |
CVE-2014-4857MEDIUM Cross-site scripting (XSS) vulnerability in Gurock TestRail before 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the Created By field in a project activi | Jul 26, 2014 | 4.3 | 14 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (7 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
14.3% of CVEs· 97th percentile
ExploitDB
1 CVE
14.3% of CVEs· 87th percentile
Social Chatter
Signals from CVEs in this product scope (7 CVEs).
Media Mentions
Signals from CVEs in this product scope (7 CVEs).
Top CNAs Publishing CVEs For Testrail
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 5.6.0.3853 | 1 | 8.8 | 2.7% | 0 | 0 |
| 5.3.0.3603 | 2 | 5.3 | 1.3% | 0 | 0 |