CVE-2024-2557: Improper Authorization

A vulnerability was found in kishor-23 Food Waste Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/admin.php. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed t...

PT-2024-15129

Name of the Vulnerable Software and Affected Versions Limit Login Attempts Reloaded plugin for WordPress versions up to, and including, 2.25.26 Description The issue is related to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input sanitization and output escaping on...

CVE-2023-1947 taoCMS admin.php code injection

A vulnerability was found in taoCMS 3.0.2. It has been classified as critical. Affected is an unknown function of the file /admin/admin.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used...

CVE-2023-1947

A vulnerability was found in taoCMS 3.0.2. It has been classified as critical. Affected is an unknown function of the file /admin/admin.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used...

CVE-2023-1947: Improper Control of Generation of Code

A vulnerability was found in taoCMS 3.0.2. It has been classified as critical. Affected is an unknown function of the file /admin/admin.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used...

CVE-2021-34167: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability in taoCMS 3.0.2 allows remote attackers to gain escalated privileges via taocms/admin/admin.php...

PT-2023-12248

Name of the Vulnerable Software and Affected Versions taoCMS version 3.0.2 Description A Cross Site Request Forgery CSRF issue allows remote attackers to gain escalated privileges via the "taocms/admin/admin.php" endpoint. This can be exploited to perform unauthorized actions. Recommendations For...

CVE-2023-0840: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic was found in PHPCrazy 1.1.1. This vulnerability affects unknown code of the file admin/admin.php?action=users&mode=info&user=2. The manipulation of the argument username leads to cross site scripting. The attack can be initiated remotely. The exploit has...

CVE-2022-3973: Improper Neutralization

A vulnerability classified as critical has been found in Pingkon HMS-PHP. Affected is an unknown function of the file /admin/admin.php of the component Data Pump Metadata. The manipulation of the argument uname/pass leads to sql injection. It is possible to launch the attack remotely. The exploit...

CVE-2022-3973

A vulnerability classified as critical has been found in Pingkon HMS-PHP. Affected is an unknown function of the file /admin/admin.php of the component Data Pump Metadata. The manipulation of the argument uname/pass leads to sql injection. It is possible to launch the attack remotely. The exploit...

Fast Flow < 1.2.13 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Create/edit a dashboard with an HTML widget...

Sql injection

A vulnerability classified as critical has been found in Kama Click Counter Plugin up to 3.4.8. This affects an unknown part of the file wp-admin/admin.php. The manipulation of the argument orderby/order with the input ASC%2cselectfromselectsleep2a leads to sql injection Blind. It is possible to...

CVE-2017-20103 Kama Click Counter Plugin admin.php Blind sql injection

A vulnerability classified as critical has been found in Kama Click Counter Plugin up to 3.4.8. This affects an unknown part of the file wp-admin/admin.php. The manipulation of the argument orderby/order with the input ASC%2cselectfromselectsleep2a leads to sql injection Blind. It is possible to...

CVE-2017-20103

CVE-2017-20103 describes a blind SQL injection in the Kama Click Counter Plugin (up to version 3.4.8) affecting wp-admin/admin.php via the order_by/order parameter (ASC, (select sleep(2))). The vulnerability can be exploited remotely and the public exploit has been disclosed. Upgrading to version...

CVE-2017-20103: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical has been found in Kama Click Counter Plugin up to 3.4.8. This affects an unknown part of the file wp-admin/admin.php. The manipulation of the argument orderby/order with the input ASC%2cselectfromselectsleep2a leads to sql injection Blind. It is possible to...

PT-2022-7976

Name of the Vulnerable Software and Affected Versions Kama Click Counter Plugin versions up to 3.4.8 Description A critical vulnerability has been found in the Kama Click Counter Plugin. This issue affects an unknown part of the file wp-admin/admin.php. The manipulation of the order by/order...

PT-2022-12711

Name of the Vulnerable Software and Affected Versions H.H.G Multistore versions 5.1.0 and below Description The issue is related to a SQL injection vulnerability. It can be exploited via the /admin/admin.php?module=admin group edit&agID API endpoint. Recommendations For versions 5.1.0 and below,...

PT-2022-12713

Name of the Vulnerable Software and Affected Versions H.H.G Multistore versions 5.1.0 and below Description The issue is a SQL injection vulnerability. It can be exploited via the "/admin/admin.php?module=admin access group edit&aagID" endpoint, specifically targeting the aagID variable. This...

CVE-2021-46444: Improper Neutralization of Special Elements used in an SQL Command

H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admingroupedit&agID...

CVE-2021-46446: Improper Neutralization of Special Elements used in an SQL Command

H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=adminaccessgroupedit&aagID...