CVE-2022-23316

An issue was discovered in taoCMS v3.0.2. There is an arbitrary file read vulnerability that can read any files via admin.php?action=file&ctrl=download&path=../../1.txt...

CVE-2022-23316: Files or Directories Accessible to External Parties

An issue was discovered in taoCMS v3.0.2. There is an arbitrary file read vulnerability that can read any files via admin.php?action=file&ctrl=download&path=../../1.txt...

PT-2022-15923

Name of the Vulnerable Software and Affected Versions taoCMS version 3.0.2 Description An issue in taoCMS allows for an arbitrary file read, enabling access to any files. This is achieved via the "admin.php" endpoint with specific parameters: action set to "file", ctrl set to "download", and path...

CVE-2021-46444: Improper Neutralization of Special Elements used in an SQL Command

H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admingroupedit&agID...

CVE-2021-46446: Improper Neutralization of Special Elements used in an SQL Command

H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=adminaccessgroupedit&aagID...

PT-2022-12711

Name of the Vulnerable Software and Affected Versions H.H.G Multistore versions 5.1.0 and below Description The issue is related to a SQL injection vulnerability. It can be exploited via the /admin/admin.php?module=admin group edit&agID API endpoint. Recommendations For versions 5.1.0 and below,...

PT-2022-12713

Name of the Vulnerable Software and Affected Versions H.H.G Multistore versions 5.1.0 and below Description The issue is a SQL injection vulnerability. It can be exploited via the "/admin/admin.php?module=admin access group edit&aagID" endpoint, specifically targeting the aagID variable. This...

PT-2022-10696

Name of the Vulnerable Software and Affected Versions Cacti version 1.1.38 Description The issue allows authenticated users with User Management permissions to inject arbitrary HTML in the group prefix field during the creation of a new group via the "Copy" method at the "user group admin.php"...

PT-2022-9380

Name of the Vulnerable Software and Affected Versions Cacti version 1.1.38 Description The issue allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the new username field during creation of a new user via the "Copy" method at the "user admin.php"...

CVE-2022-0233: Improper Neutralization of Input During Web Page Generation

The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the pmuseravatar and pmcoverimage parameters found in the /admin/class-profile-magic-admin.php file which allows attackers with...

PT-2022-13052

Name of the Vulnerable Software and Affected Versions The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin versions up to and including 1.2.7 Description The issue arises from insufficient escaping via the pm user avatar and pm cover image parameters in the...

SupportCandy < 2.2.7 - CSRF to Cross-Site Scripting

The plugin does not have CSRF check in the wpsctickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter stored in their cookies with an XSS payloa...

CVE-2020-21236: Cross-Site Request Forgery (CSRF)

A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a user's session cookie...

Profile Extra Fields < 1.2.4 - Reflected Cross-Site Scripting

The plugin does not escape the role parameter when outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue https://example.com/wp-admin/admin.php?page=profile-extra-fields.php&tab-action=userdata&role="alert/XSS/...

ZZCMS Access Control Error Vulnerability

ZZCMS is a content management system CMS from the Zzcms team in China. ZZCMS suffers from an access control error vulnerability that stems from an incorrect access control vulnerability in zzcms via admin.php, which can be exploited by an attacker to directly access the administrator console afte...

Improper access control

An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php. After disabling JavaScript, you can directly access the administrator console...

CVE-2021-43703

An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php. After disabling JavaScript, you can directly access the administrator console...

CVE-2021-43703

An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php. After disabling JavaScript, you can directly access the administrator console...

PT-2021-23922

Name of the Vulnerable Software and Affected Versions: zzcms versions less than or equal to 2019 Description: An issue exists due to incorrect access control in zzcms, allowing direct access to the administrator console via "admin.php" after disabling JavaScript. Recommendations: For zzcms versio...

CVE-2021-43703: Undefined Security Weakness

An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php. After disabling JavaScript, you can directly access the administrator console...