40 matches found
CVE-2019-25529: Improper Neutralization of Special Elements used in an SQL Command
Placeto CMS Alpha rv.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'page' parameter. Attackers can send GET requests to the admin/edit.php endpoint with malicious 'page' values using boolean-based...
CVE-2019-25490: Improper Neutralization of Special Elements used in an SQL Command
Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id' parameter. Attackers can send GET requests to the admin/edit.php endpoint with time-based SQL injection payloads to extract sensitive...
CVE-2025-15262: Unrestricted Upload of File with Dangerous Type
A security flaw has been discovered in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/edit.php of the component Site Logo Handler. Performing a manipulation of the argument image results in unrestricted upload. Remote exploitation of the attack is possible. The...
EUVD-2024-20247
Malicious code in bioql PyPI...
CVE-2025-10828: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown part of the file /admin/edit.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly an...
CVE-2015-5355
Multiple cross-site scripting XSS vulnerabilities in GetSimple CMS before 3.3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 post-content or 2 post-title parameter to admin/edit.php...
CVE-2024-3419
CVE-2024-3419 affects SourceCodester Online Courseware 1.0; SQL injection via the id parameter in admin/edit.php is the root cause. The vulnerability is exploitable remotely and exploits have been publicly disclosed. No patch/version fix details are provided in the connected documents. Mitigation...
PT-2024-25729 · Unknown · Sourcecodester Online Courseware
Name of the Vulnerable Software and Affected Versions: SourceCodester Online Courseware version 1.0 Description: A critical issue has been found in the software, affecting an unknown functionality of the file admin/edit.php. The manipulation of the id argument leads to SQL injection. The attack c...
CVE-2024-22715
Stupid Simple CMS =1.2.4 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin-edit.php...
CVE-2024-22715
Stupid Simple CMS =1.2.4 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin-edit.php...
CVE-2024-22715
Summary (from provided records): Stupid Simple CMS
CVE-2023-51246
A Cross Site Scripting XSS vulnerability in GetSimple CMS 3.3.16 exists when using Source Code Mode as a backend user to add articles via the /admin/edit.php page...
CVE-2023-51246
CVE-2023-51246 concerns GetSimple CMS 3.3.16 where an XSS exists when a backend user adds articles via /admin/edit.php with Source Code Mode active. The root cause is inadequate filtering/escaping of user-supplied data during article creation, leading to arbitrary script execution. Affected produ...
PT-2023-28960 · Unknown · Online Book Store Project
Name of the Vulnerable Software and Affected Versions: Online Book Store Project version 1.0 Description: The issue allows an authenticated attacker to obtain Remote Code Execution on the server hosting the application via an Insecure File Upload vulnerability on the image parameter of the "admin...
CVE-2020-20389
Cross Site Scripting XSS vulnerability in GetSimpleCMS 3.4.0a in admin/edit.php...
CVE-2020-20389
Cross Site Scripting XSS vulnerability in GetSimpleCMS 3.4.0a in admin/edit.php...
CVE-2020-20389
Cross Site Scripting XSS vulnerability in GetSimpleCMS 3.4.0a in admin/edit.php...
CVE-2016-10962
The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php optionname parameter...
