49 matches found
Petrol Pump Management Software Code Issue Vulnerability
Petrol Pump Management Software is a gasoline pump management software by mayurik individual developer. A code issue vulnerability exists in Petrol Pump Management Software version 1.0, which stems from an unrestricted upload issue in the /admin/app/product.php file...
PT-2024-18684
Name of the Vulnerable Software and Affected Versions SourceCodester Petrol Pump Management Software version 1.0 Description A critical issue affects some unknown functionality of the file /admin/app/service crud.php, allowing unrestricted upload through the manipulation of the photo argument. Th...
CVE-2024-2060: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in SourceCodester Petrol Pump Management Software 1.0. This affects an unknown part of the file /admin/app/logincrud.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploi...
CVE-2024-2058: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/app/product.php. The manipulation of the argument photo leads to unrestricted upload. The attack can be...
CVE-2024-2059: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/app/servicecrud.php. The manipulation of the argument photo leads to unrestricted upload. The attack may be...
CVE-2023-50175
Stored cross-site scripting vulnerability exists in the App Settings /admin/app page, the Markdown Settings /admin/markdown page, and the Customize /admin/customize page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser o...
PT-2023-29660 · Growi · Growi
Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v3.5.0 Description: A stored cross-site scripting issue exists in the App Settings /admin/app page and the Markdown Settings /admin/markdown page. If exploited, an arbitrary script may be executed on the web browser of...
PT-2023-31487 · Growi · Growi
Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.0.0 Description: A stored cross-site scripting issue exists in the App Settings /admin/app page, the Markdown Settings /admin/markdown page, and the Customize /admin/customize page. This could allow an arbitrary...
CVE-2023-21320
In Device Policy, there is a possible way to verify if a particular admin app is registered on the device due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
Malwarebytes Admin update: New Detection screens to manage threats!
We released version 1.2 of the Malwarebytes Admin app for iOS and Android last week, adding new Detection features make it easier to see and manage threats. Designed as a companion to the Nebula console, Malwarebytes Admin allows administrators to quickly review, investigate, and resolve security...
CVE-2020-19158: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via the 'Site Title' parameter of the component '/data/admin//app/config/'...
PT-2021-10298
Name of the Vulnerable Software and Affected Versions: S-CMS versions 20191014 and earlier Description: The issue allows remote attackers to execute arbitrary code via the Site Title parameter of the component "/data/admin//app/config/". This enables attackers to perform Cross Site Scripting XSS...
CVE-2020-36005
AppCMS 2.0.101 in /admin/app.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitrary files on the site...
PT-2020-20433
Name of the Vulnerable Software and Affected Versions LiteCart versions prior to 2.2.2 Description The issue allows for a CSRF attack via the "admin/?app=users&doc=edit user" endpoint to add a user. Recommendations For versions prior to 2.2.2, update to version 2.2.2 or later to resolve the issue...
CVE-2020-9018: Cross-Site Request Forgery (CSRF)
LiteCart through 2.2.1 allows admin/?app=users&doc=edituser CSRF to add a user...
CVE-2019-2193
In WelcomeActivity.java and related files, there is a possible permissions bypass due to a partially provisioned Device Policy Client. This could lead to local escalation of privilege, leaving an Admin app installed with no indication to the user, with User execution privileges needed. User...
PT-2019-16283
Name of the Vulnerable Software and Affected Versions Android versions 8.0 through 10 Description The issue is related to a possible permissions bypass due to a partially provisioned Device Policy Client. This could lead to local escalation of privilege, allowing an Admin app to be installed...
CVE-2019-11021: Unrestricted Upload of File with Dangerous Type
admin/app/mediamanager in Schlix CMS 2.1.8-7 allows Authenticated Unrestricted File Upload, leading to remote code execution. NOTE: "While inadvertently allowing a PHP file to be uploaded via Media Manager was an oversight, it still requires an admin permission. We think it's pretty rare for an...
CVE-2018-12256
admin/vqmods.app/vqmods.inc.php in LiteCart before 2.1.3 allows remote authenticated attackers to upload a malicious file resulting in remote code execution by using the text/xml or application/xml Content-Type in a publichtml/admin/?app=vqmods&doc=vqmods request...