82 matches found
CVE-2023-25223
CRMEB =1.3.4 is vulnerable to SQL Injection via /api/admin/user/list...
Sql injection
A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It has been classified as critical. This affects an unknown part of the file /api/admin/system/store/order/list. The manipulation of the argument keywords leads to sql injection. The exploit has been disclosed to the public and may be used...
CVE-2023-1165
A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It has been classified as critical. This affects an unknown part of the file /api/admin/system/store/order/list. The manipulation of the argument keywords leads to sql injection. The exploit has been disclosed to the public and may be used...
CVE-2023-1165 Zhong Bang CRMEB Java list sql injection
A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It has been classified as critical. This affects an unknown part of the file /api/admin/system/store/order/list. The manipulation of the argument keywords leads to sql injection. The exploit has been disclosed to the public and may be used...
CVE-2023-1165: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It has been classified as critical. This affects an unknown part of the file /api/admin/system/store/order/list. The manipulation of the argument keywords leads to sql injection. The exploit has been disclosed to the public and may be used...
CVE-2022-4597: Improper Neutralization
A vulnerability, which was classified as problematic, was found in Shoplazza LifeStyle 1.1. Affected is an unknown function of the file /admin/api/admin/v2products of the component Create Product Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely...
CVE-2022-32994
Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload...
PT-2022-21628
Name of the Vulnerable Software and Affected Versions Halo CMS version 1.5.3 Description The issue is related to an arbitrary file upload vulnerability. This vulnerability can be exploited via the /api/admin/attachments/upload API endpoint. Recommendations For Halo CMS version 1.5.3, consider...
CVE-2022-32994: Unrestricted Upload of File with Dangerous Type
Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload...
Exploit for Insecure Storage of Sensitive Information in Apache Kylin
Description Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1,...
PT-2020-15366
Name of the Vulnerable Software and Affected Versions halo version 1.1.3 Description The issue is related to a XML external entity XXE vulnerability. It affects the function of importing other blogs in the background, specifically through the /api/admin/migrations/wordpress endpoint, which parses...
API Admin Auth Weakness in tomato
Versions of tomato prior to 0.0.6 are affected by a somewhat complex authentication bypass vulnerability in the admin service when only a single access key is configured on the server. The vulnerability allows an attacker to guess the password for the admin service, no matter how complex that...
PT-2019-13729
Name of the Vulnerable Software and Affected Versions EMCA Energy Logserver version 6.1.2 Description The issue concerns the api/admin/logoupload Logo File upload feature, which allows attackers to upload files to any location on the server. This is achieved through path traversal in the filename...
CVE-2019-14521: Improper Limitation of a Pathname to a Restricted Directory
The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location on the server via path traversal in the filename parameter...
CVE-2018-7063: Improper Restriction of XML External Entity Reference
In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may still be able to perform read/write operations on parts of the XML API. This can lead to unauthorized access to the API and complete...
Cross site request forgery (csrf)
JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...
CVE-2018-19544
JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news...
PT-2018-14990
Name of the Vulnerable Software and Affected Versions JEECMS version 9.3 Description The issue allows for CSRF via the "api/admin/role/save" API endpoint to add a user. Recommendations For JEECMS version 9.3, consider implementing proper CSRF protection mechanisms to prevent unauthorized actions...
PT-2018-14989
Name of the Vulnerable Software and Affected Versions JEECMS version 9.3 Description The issue allows for CSRF via the "api/admin/content/save" API endpoint to add news. Recommendations For JEECMS version 9.3, as a temporary workaround, consider restricting access to the "api/admin/content/save"...