Jorani
Vulnerability activity for Jorani: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 5.4MediumOct 13, 2026Jorani Auth bypass / access controlCVE-2026-110100Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can submit a contract id and URL via POST to overwrite non-working-day calendars and abuse get_headers() and fopen() for server-side request forgery against internal hosts.
- 4.3MediumOct 13, 2026Jorani Auth bypass / access controlCVE-2026-110099Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated user to export HR data. Attackers can request hr/exportEmployees or hr/exportLeaves/{id} and hr/exportOvertime/{id} to download employee names, emails, contracts, managers, and any employee's leave and overtime records.
- 5.4MediumOct 13, 2026Jorani Auth bypass / access controlCVE-2026-110098Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit(), Extra::edit(), Leaves::delete(), Extra::delete(), and Leaves::history() to tamper with colleagues' leave and overtime requests and read leave history.
- 7.6HighFeb 17, 2026jorani SQL injectionCVE-2025-67102A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attacker to execute arbitrary SQL commands via the entity parameter.
Top products
- Jorani4 CVEs in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.