CVE-2021-32008

This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Improper Limitation of a Pathname to restricted directory, allows logged in GateManager admin to delete system Files or Directories...

CVE-2022-26483

An issue was discovered in Veritas InfoScale Operations Manager VIOM before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. A reflected cross-site scripting XSS vulnerability in admin/cgi-bin/listdir.pl allows authenticated remote administrators to inject arbitrary web script or HTML into an HTTP...

PT-2022-10059

Name of the Vulnerable Software and Affected Versions Secomea GateManager versions prior to 9.6.621421014 Description The issue is related to an improper limitation of a pathname to a restricted directory. This allows a logged-in GateManager admin to delete system files or directories...

PT-2022-8592

Name of the Vulnerable Software and Affected Versions Intelliants Subrion CMS version 4.2.1 Description A Cross Site Request Forgery CSRF issue exists via the Members administrator function, allowing a remote unauthenticated malicious user to send an authorized request to a victim and successfull...

CVE-2021-32008: Files or Directories Accessible to External Parties

This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Improper Limitation of a Pathname to restricted directory, allows logged in GateManager admin to delete system Files or Directories...

CVE-2022-24573

A stored cross-site scripting XSS vulnerability in the admin interface in Element-IT HTTP Commander 7.0.0 allows unauthenticated users to get admin access by injecting a malicious script in the User-Agent field...

CVE-2022-24573

A stored cross-site scripting XSS vulnerability in the admin interface in Element-IT HTTP Commander 7.0.0 allows unauthenticated users to get admin access by injecting a malicious script in the User-Agent field...

CVE-2022-24573: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the admin interface in Element-IT HTTP Commander 7.0.0 allows unauthenticated users to get admin access by injecting a malicious script in the User-Agent field...

PT-2022-16727

Name of the Vulnerable Software and Affected Versions Element-IT HTTP Commander version 7.0.0 Description A stored cross-site scripting XSS vulnerability in the admin interface allows unauthenticated users to gain admin access by injecting a malicious script in the User-Agent field. This issue...

CVE-2022-25045

Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel...

CVE-2022-25045

Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel...

Hardcoded credentials

Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel...

PT-2022-16568

Name of the Vulnerable Software and Affected Versions Extensis Portfolio version 4.0 Description The issue concerns hardcoded credentials in the software, which can be exploited by attackers to gain administrator privileges. Recommendations For Extensis Portfolio version 4.0, consider changing th...

CVE-2022-24571

Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...

CVE-2022-24571

Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...

CVE-2022-24571

Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...

Sql injection

Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...

CVE-2022-24571

CVE-2022-24571 involves Car Driving School Management System v1.0, where the login page is vulnerable to SQL injection. The root cause is improper input handling on the username parameter, enabling attackers to alter the SQL query and bypass authentication. This can grant admin access and potenti...

CVE-2022-24571

Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...

Privilege Escalation

dolibarr/dolibarr is vulnerable to privilege escalation. Low privileged attacker is able to update their login name which should only be updated by admin allowing the attacker to gain access to sensitive information and elevate privileges...