https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2002-0487.htmlhttps://patchthecve.com/cve/CVE-2002-0487.htmlTue, 16 Jun 2026 21:57:32 +0000MEDIUM 4.6: Intellisol Xpede 4.1 stores passwords in plaintext in a Javascript "session timeout" re-authentication capability, which could allow local users with access to gain privileges of other Xpede users by reading the password from the source file, e.g. from the browser's cache.https://patchthecve.com/cve/CVE-2002-0486.htmlhttps://patchthecve.com/cve/CVE-2002-0486.htmlTue, 16 Jun 2026 21:57:32 +0000HIGH 7.2: Intellisol Xpede 4.1 uses weak encryption to store authentication information in cookies, which could allow local users with access to the cookies to gain privileges.https://patchthecve.com/cve/CVE-2002-0584.htmlhttps://patchthecve.com/cve/CVE-2002-0584.htmlTue, 16 Jun 2026 21:57:43 +0000MEDIUM 5.0: WorkforceROI Xpede 4.1 allows remote attackers to read user timesheets by modifying the TSN ID parameter to the ts_app_process.asp script, which is easily guessable because it is incremented by 1 for each new timesheet.https://patchthecve.com/cve/CVE-2002-0583.htmlhttps://patchthecve.com/cve/CVE-2002-0583.htmlTue, 16 Jun 2026 21:57:43 +0000MEDIUM 5.0: WorkforceROI Xpede 4.1 uses a small random namespace (5 alphanumeric characters) for temporary expense claim reports in the /reports/temp directory, which allows remote attackers to read the reports via a brute force attack.https://patchthecve.com/cve/CVE-2002-0582.htmlhttps://patchthecve.com/cve/CVE-2002-0582.htmlTue, 16 Jun 2026 21:57:43 +0000MEDIUM 5.0: WorkforceROI Xpede 4.1 stores temporary expense claim reports in a world-readable and indexable /reports/temp directory, which allows remote attackers to read the reports by accessing the directory.https://patchthecve.com/cve/CVE-2002-0581.htmlhttps://patchthecve.com/cve/CVE-2002-0581.htmlTue, 16 Jun 2026 21:57:43 +0000HIGH 7.5: WorkforceROI Xpede 4.1 allows remote attackers to execute arbitrary SQL commands and read, modify, or steal credentials from the database via the Qry parameter in the sprc.asp script.https://patchthecve.com/cve/CVE-2002-0580.htmlhttps://patchthecve.com/cve/CVE-2002-0580.htmlTue, 16 Jun 2026 21:57:42 +0000HIGH 7.5: WorkforceROI Xpede 4.1 allows remote attackers to obtain the database username via a request to datasource.asp, which leaks the username in a form and allows the attacker to more easily conduct brute force password guessing attacks.https://patchthecve.com/cve/CVE-2002-0579.htmlhttps://patchthecve.com/cve/CVE-2002-0579.htmlTue, 16 Jun 2026 21:57:42 +0000HIGH 7.5: WorkforceROI Xpede 4.1 allows remote attackers to gain privileges as an Xpede administrator via a direct HTTP request to the /admin/adminproc.asp script, which does not prompt for a password.