Wolterskluwer

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-1493 1Wolterskluwer 1Lex Baza Dokumentow Jun 17, 2026 Apr 30, 2026 4.6 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 LEX Baza Dokumentów is vulnerable to DOM-based XSS in "em" cookie parameter. The application unsafely processes the parameter on the client side, allowing an attacker to execute arbitrary JavaScript in the context of the...Show more LEX Baza Dokumentów is vulnerable to DOM-based XSS in "em" cookie parameter. The application unsafely processes the parameter on the client side, allowing an attacker to execute arbitrary JavaScript in the context of the victim's browser. An attacker with ability to set a cookie can perform a more severe attack, so we evaluate the impact and risk of exploitation as minimal. However, the vendor considered this a vulnerability and released a security patch. This issue was fixed in version 1.3.4.Show less
CVE-2026-2680 1Wolterskluwer 1A3factura Jun 17, 2026 Feb 26, 2026 4.8 MEDIUM· v4 6.1 MEDIUM· v3 N/A· v2 Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerVATNumber', in 'a3factura-app.wolterskluwer.es/#/incomes/salesDeliveryNotes' endpoint, which could allow an attacker to execute ar...Show more Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerVATNumber', in 'a3factura-app.wolterskluwer.es/#/incomes/salesDeliveryNotes' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser.Show less
CVE-2026-2679 1Wolterskluwer 1A3factura Jun 17, 2026 Feb 26, 2026 4.8 MEDIUM· v4 6.1 MEDIUM· v3 N/A· v2 Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerName', in 'a3factura-app.wolterskluwer.es/#/incomes/salesInvoices' endpoint, which could allow an attacker to execute arbitrary co...Show more Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerName', in 'a3factura-app.wolterskluwer.es/#/incomes/salesInvoices' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser.Show less
CVE-2026-2678 1Wolterskluwer 1A3factura Jun 17, 2026 Feb 26, 2026 4.8 MEDIUM· v4 6.1 MEDIUM· v3 N/A· v2 Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'name', parameter 'name', in 'a3factura-app.wolterskluwer.es/#/incomes/customers' endpoint, which could allow an attacker to execute arbitr...Show more Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'name', parameter 'name', in 'a3factura-app.wolterskluwer.es/#/incomes/customers' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser.Show less
CVE-2026-2677 1Wolterskluwer 1A3factura Jun 17, 2026 Feb 26, 2026 4.8 MEDIUM· v4 6.1 MEDIUM· v3 N/A· v2 Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'name', in 'a3factura-app.wolterskluwer.es/#/incomes/representatives-management' endpoint, which could allow an attacker to execute arbitra...Show more Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'name', in 'a3factura-app.wolterskluwer.es/#/incomes/representatives-management' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser.Show less
CVE-2023-49328 1Wolterskluwer 1B.point Jun 17, 2026 Dec 25, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 On a Wolters Kluwer B.POINT 23.70.00 server running Linux on premises, during the authentication phase, a validated system user can achieve remote code execution via Argument Injection in the server-to-server module.
CVE-2023-33438 1Wolterskluwer 1Teammate+ Jul 9, 2026 Jun 16, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A stored Cross-site scripting (XSS) vulnerability in Wolters Kluwer TeamMate+ 35.0.11.0 allows remote attackers to inject arbitrary web script or HTML.
CVE-2021-41932 1Wolterskluwer 1Teammate+ Audit Jun 17, 2026 Jun 6, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A blind SQL injection vulnerability in search form in TeamMate+ Audit version 28.0.19.0 allows any authenticated user to create malicious SQL injections, which can result in complete database compromise, gaining informat...Show more A blind SQL injection vulnerability in search form in TeamMate+ Audit version 28.0.19.0 allows any authenticated user to create malicious SQL injections, which can result in complete database compromise, gaining information about other users, unauthorized access to audit data etc.Show less
CVE-2021-44035 1Wolterskluwer 1Teammate Audit Management Jun 17, 2026 Dec 17, 2021 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Wolters Kluwer TeamMate AM 12.4 Update 1 mishandles attachment uploads, such that an authenticated user may download and execute malicious files.
CVE-2010-3125 1Wolterskluwer 1Teammate Audit Management Software Suite Apr 29, 2026 Aug 26, 2010 N/A· v4 N/A· v3 9.3 HIGH· v2 Untrusted search path vulnerability in TeamMate Audit Management Software Suite 8.0 patch 2 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan hors...Show more Untrusted search path vulnerability in TeamMate Audit Management Software Suite 8.0 patch 2 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse mfc71enu.dll that is located in the same folder as a .tmx file.Show less