CVE-2022-27885: Improper Neutralization of Input During Web Page Generation

Maccms v10 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities in /admin.php/admin/website/data.html via the select and input parameters...

CVE-2022-27884: Improper Neutralization of Input During Web Page Generation

Maccms v10 was discovered to contain a reflected cross-site scripting XSS vulnerability in /admin.php/admin/plog/index.html via the wd parameter...

PT-2022-18667

Name of the Vulnerable Software and Affected Versions Maccms version 10 Description A reflected cross-site scripting XSS issue was found in the /admin.php/admin/ulog/index.html endpoint via the wd parameter. This allows for potential malicious script execution. Recommendations For Maccms version...

CVE-2022-26965: Unrestricted Upload of File with Dangerous Type

In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution...

TaoCMS arbitrary file reading vulnerability

Taocms is a micro Cms content management system in China.TaoCMS has an arbitrary file reading vulnerability that can be exploited by attackers via admin.php?action=file & ctrl=download & path=... /... /1.txt to read any file...

PT-2022-18145

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.16 Description The issue allows an admin user to perform remote code execution using the theme upload functionality. This is achieved through the "/admin.php?action=themeinstall" endpoint. Recommendations For Pluck version...

Loki RAT (Relapse) SQL Injection

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/aabb54951546132e70a8e9f02bf8b5baB.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Loki RAT Relapse Vulnerability: SQL Injection Description: The LokiRAT WebUI panel for...

Loki RAT (Relapse) Directory Traversal / Arbitrary File Deletion

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/aabb54951546132e70a8e9f02bf8b5ba.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Loki RAT Relapse Vulnerability: Directory Traversal - Arbitrary File Delete Description: The LokiRAT...

CVE-2022-25403

HMS v1.0 was discovered to contain a SQL injection vulnerability via the component admin.php...

Sql injection

HMS v1.0 was discovered to contain a SQL injection vulnerability via the component admin.php...

CVE-2022-25403

HMS v1.0 was discovered to contain a SQL injection vulnerability via the component admin.php...

CVE-2022-25403

HMS v1.0 was discovered to contain a SQL injection vulnerability via the component admin.php...

CVE-2022-25403

CVE-2022-25403 affects HMS v1.0, with a SQL injection vulnerability in the admin.php component. The issue stems from inadequate handling/validation of user input in admin.php, allowing injection of arbitrary SQL statements. Reported impact in CVSS indicates high severity with partial confidential...

PT-2022-17266

Name of the Vulnerable Software and Affected Versions HMS version 1.0 Description A SQL injection issue was found in the admin.php component. Recommendations For version 1.0, consider restricting access to the admin.php component until a fix is available...

CVE-2022-25403: Improper Neutralization of Special Elements used in an SQL Command

HMS v1.0 was discovered to contain a SQL injection vulnerability via the component admin.php...

CVE-2022-24981

A reflected cross-site scripting XSS vulnerability in forms generated by JQueryForm.com before 2022-02-05 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to admin.php...

CVE-2022-24982

Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to access the cleartext credentials of all other form users. admin.php contains a hidden base64-encoded string with these credentials...

Design/Logic Flaw

Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to access the cleartext credentials of all other form users. admin.php contains a hidden base64-encoded string with these credentials...

Cross site scripting

A reflected cross-site scripting XSS vulnerability in forms generated by JQueryForm.com before 2022-02-05 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to admin.php...

CVE-2022-24981

CVE-2022-24981 describes a reflected XSS in forms generated by JQueryForm.com prior to 2022-02-05. The vulnerability is triggered via the redirect parameter to admin.php, allowing remote attackers to inject arbitrary web script or HTML. Documents consistently identify the affected component as th...