Jorani Project develops a focused human-resources and leave-management application, with a vulnerability profile centered on web application input-handling issues such as cross-site scripting and SQL injection. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Jorani Project over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-26469CRITICAL In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server. | Aug 17, 2023 | 9.8 | 88 | NO | YES |
CVE-2018-15917MEDIUM Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language. | Sep 5, 2018 | 5.4 | 40 | NO | YES |
CVE-2022-34132CRITICAL Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php. | Jun 28, 2022 | 9.8 | 30 | NO | NO |
CVE-2018-15918MEDIUM An issue was discovered in Jorani 0.6.5. SQL Injection (error-based) allows a user of the application without permissions to read and modify sensitive information from the database | Sep 5, 2018 | 5.4 | 30 | NO | YES |
CVE-2023-2681HIGH An SQL Injection vulnerability has been found on Jorani version 1.0.0. This vulnerability allows an authenticated remote user, with low privileges, to send queries with malicious S | Oct 3, 2023 | 8.8 | 26 | NO | NO |
CVE-2025-67102HIGH A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attacker to execute arbitrary SQL commands via the entity parameter. | Feb 17, 2026 | 7.6 | 25 | NO | NO |
CVE-2022-34134HIGH Jorani v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /application/controllers/Users.php. | Jun 28, 2022 | 8.8 | 22 | NO | NO |
CVE-2022-34133MEDIUM Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Comment parameter at application/controllers/Leaves.php. | Jun 28, 2022 | 6.1 | 22 | NO | NO |
CVE-2023-45540MEDIUM An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List of Leave requests pag | Oct 16, 2023 | 6.5 | 21 | NO | NO |
CVE-2022-48118MEDIUM Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter. | Jan 27, 2023 | 6.1 | 21 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Jorani Project.
Media articles that mention a CVE ID that affects a product developed by Jorani Project — matched by CVE ID, not by vendor name.