Rukovoditel Rukovoditel vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Rukovoditel Rukovoditel: 3 record(s), with affected versions and fixes.cpe:2.3:a:rukovoditel:rukovoditel
CVE-2023-53913
High · 8.8
CWE-1236 Dec 17, 2025
Rukovoditel 3.3.1 CSV Injection via User Account Export
Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field. Attackers can craft payloads like =calc|a!z| to trigger code execution when an admin exports customer data as a CSV file.
CVE-2023-53898
Medium · 5.4
CWE-79 Dec 16, 2025
Rukovoditel 3.4.1 Multiple Stored Cross-Site Scripting via Configuration
Rukovoditel 3.4.1 contains a stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can insert iframe and script payloads in application copyright text to execute arbitrary JavaScript in victim browsers.
CVE-2023-53897
Medium · 5.4
CWE-79 Dec 16, 2025
Rukovoditel 3.4.1 Multiple Stored Cross-Site Scripting via Comments
Rukovoditel 3.4.1 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can insert XSS payloads in project task comments to execute arbitrary JavaScript in victim browsers.