Webtareas Project vulnerabilities
Published CVEs affecting Webtareas Project products: 2 record(s), with severity, exploitation and fixes.
CVE-2023-53972
High · 7.5
CWE-89 Dec 22, 2025
WebTareas 2.4 Unauthenticated SQL Injection via Session Cookie Parameter
WebTareas 2.4 contains a SQL injection vulnerability in the webTareasSID cookie parameter that allows unauthenticated attackers to manipulate database queries. Attackers can exploit error-based and time-based blind SQL injection techniques to extract database information and potentially access sensitive system data.
CVE-2023-53971
High · 8.8
CWE-434 Dec 22, 2025
WebTareas 2.4 Authenticated Remote Code Execution via File Upload
WebTareas 2.4 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the chat photo upload functionality. Attackers can upload a PHP file with arbitrary code to the /files/Messages/ directory and execute it directly through the generated file path.