CVE-2023-48016

Restaurant Table Booking System V1.0 is vulnerable to SQL Injection in rtbs/admin/index.php via the username parameter...

CVE-2023-48882

A stored cross-site scripting XSS vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Document Properties field at /login.php m=admin&c=Index&a=changeTableVal&ajax=1&lang=cn...

U.S. Dept Of Defense: Default Admin Username and Password on ███

A vulnerability was found where default administrator credentials could be used to access an application. This could have allowed unauthorized access...

There is stored XSS in version 1.6.4 which can lead to stealing sensitive information of logged-in users

Software Link : https://github.com/weng-xianhu/eyoucms Website...

PT-2023-27677 · Unknown · Phpgurukul User Registration & Login/User Management System With Admin Panel

Name of the Vulnerable Software and Affected Versions: Phpgurukul User Registration & Login and User Management System With admin panel version 3.0 Description: The issue allows attackers to obtain sensitive information via a crafted string in the admin user name field on the admin log in page...

Live News < 1.07 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

eClass Junior 4.0 SQL Injection

==================================================================================================================================== | Title : eClass Junior 4.0 Sql injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit | |...

Exploit for Cross-site Scripting in Moosocial

CVE-2023-44812 A reflected cross-site scripting XSS vulnerab...

Who’s Behind the 8Base Ransomware Website?

The victim shaming website operated by the cybercriminals behind 8Base -- currently one of the more active ransomware groups -- was until earlier today leaking quite a bit of information that the crime group probably did not intend to be made public. The leaked data suggests that at least some of...

PT-2023-31499 · Unknown · 07Fly Crm V2

Name of the Vulnerable Software and Affected Versions: 07FLY CRM V2 Description: A critical issue has been found in the Administrator Login Page component, specifically affecting the /index.php/sysmanage/Login/login auth/ file. The manipulation of the account argument leads to SQL injection. This...

SQL Injection Vulnerability in Content Page

In menu Content page, there is a SQL Injection Vulnerability at Filter function. To exploit this vulnerability, attacker injection query into filter field. Proof of Concept 1. Login with admin 2. Go to "http://127.0.0.1/icms2/admin/content/5". In this case, the number 5 is content's id Can be...

CVE-2023-40329

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPZest Custom Admin Login Page | WPZest plugin = 1.2.0 versions...

CVE-2023-40329

CVE-2023-40329 affects the WordPress plugin WPZest Custom Admin Login Page (WPZest) up to version 1.2.0. The vulnerability is an authenticated Stored Cross-Site Scripting (XSS) flaw, where user input in admin settings is not properly validated/escaped, enabling XSS with admin privileges. Several ...

CVE-2023-40329 WordPress Custom Admin Login Page | WPZest Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPZest Custom Admin Login Page | WPZest plugin = 1.2.0 versions...

CVE-2023-40329 WordPress Custom Admin Login Page | WPZest Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPZest Custom Admin Login Page | WPZest plugin = 1.2.0 versions...

WordPress plugin custom-admin-login-styler-wpzest cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

Store XSS in Widgets and pages

Description I noticed that you filtered the comment very carefully. But there are still some parts you missed Proof of Concept 1 .Login with admin 2 .Go to "https://demo.instantcms.io/admin/widgets" 3 . Insert payload in Position name and Title test" onmouseover = "alertdocument.cookie 4 .Click...

CVE-2020-11711

An issue was discovered in Stormshield SNS 3.8.0. Authenticated Stored XSS in the admin login panel leads to SSL VPN credential theft. A malicious disclaimer file can be uploaded from the admin panel. The resulting file is rendered on the authentication interface of the admin panel. It is possibl...

User Registration & Login and User Management System v3.0 - SQL Injection Vulnerability

Exploit Title: User Registration & Login and User Management System v3.0 - SQL Injection Unauthenticated Exploit Author: Ashutosh Singh Umath Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/ Version:...

User Registration And Login And User Management System 3.0 SQL Injection

Exploit Title: User Registration & Login and User Management System v3.0 - SQL Injection Unauthenticated Google Dork: NA Date: 19/08/2023 Exploit Author: Ashutosh Singh Umath Vendor Homepage: https://phpgurukul.com Software Link:...