CVE-2020-19682

A Cross Site Request Forgery CSRF vulnerability exits in ZZZCMS V1.7.1 via the saveuser funciton in save.php...

PT-2021-10387

Name of the Vulnerable Software and Affected Versions: ZZZCMS version 1.7.1 Description: A Cross Site Request Forgery CSRF issue exists via the save user function in the "save.php" endpoint. This allows for unauthorized actions to be performed on behalf of a user. Recommendations: For ZZZCMS...

ZZCMS 跨站脚本漏洞

ZZZCMS is a content management system CMS from the ZZZCMS team in China. ZZZCMS suffers from a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied and output data in the editfile action of /adminxxx/save.php. An attacker could exploit the...

ZZCMS 跨站请求伪造漏洞

ZZCMS is a content management system CMS by China Zzcms team. ZZZCMS V1.7.1 suffers from a cross-site request forgery vulnerability, which stems from the lack of token validation for cross-site request forgery in the saveuser function in save.php...

showdoc Cross-site Request Forgery Vulnerability (CNVD-2021-94821)

showdoc is an open source tool for IT teams to share documents online. showdoc is vulnerable to cross-site request forgery, which can be exploited by attackers via "/server/index.php?s=/api/itemGroup/save"...

showdoc 跨站请求伪造漏洞

showdoc is an open source tool for IT teams to share documents online. showdoc is vulnerable to cross-site request forgery, which can be exploited by attackers via "/server/index.php?s=/api/itemGroup/save"...

orangescrum 1.8.0 - (Multiple) Cross-Site Scripting Vulnerability

Exploit Title: orangescrum 1.8.0 - 'Multiple' Cross-Site Scripting XSS Authenticated Exploit Author: Hubert Wojciechowski Contact Author: email protected Company: https://redteam.pl Vendor Homepage: https://www.orangescrum.org/ Software Link: https://www.orangescrum.org/ Version: 1.8.0 Testeted o...

CVE-2021-24853

The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qrsavebulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects...

CVE-2021-24853

The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qrsavebulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects...

CVE-2021-24804

The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site...

CVE-2021-24804

The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site...

PT-2021-16335

Name of the Vulnerable Software and Affected Versions: QR Redirector WordPress plugin versions prior to 1.6 Description: The issue concerns a lack of capability and CSRF checks when saving bulk QR Redirector settings via the "qr save bulk" AJAX action. This could allow any authenticated user, suc...

CVE-2021-26326

Failure to validate VMHSAVEPA during SNPINIT may result in a loss of memory integrity...

CVE-2021-26326

Failure to validate VMHSAVEPA during SNPINIT may result in a loss of memory integrity...

CVE-2021-40261

Multiple Cross Site Scripting XSS vulnerabilities exist in SourceCodester CASAP Automated Enrollment System 1.0 via the 1 userusername and 2 category parameters in saveclass.php, the 3 firstname, 4 class, and 5 status parameters in studenttable.php, the 6 category and 7 classname parameters in...

PT-2021-22849

Name of the Vulnerable Software and Affected Versions SourceCodester CASAP Automated Enrollment System version 1.0 Description Multiple Cross Site Scripting XSS vulnerabilities exist in the system via various parameters in different PHP files, including user username and category in "save...

CVE-2020-23566

Irfanview v4.53 was discovered to contain an infinity loop via JPEG2000!ShowPlugInSaveOptionsW+0x1ecd8...

kernel: SVM nested virtualization issue in KVM (VMLOAD/VMSAVE)

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB virtual machine control block provided by the L1 guest to spawn/handle a nested guest L2. Due to improper validation of the "virtext" field, this issue could allow a malicious...

kernel: SVM nested virtualization issue in KVM (VMLOAD/VMSAVE)

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB virtual machine control block provided by the L1 guest to spawn/handle a nested guest L2. Due to improper validation of the "virtext" field, this issue could allow a malicious...

PT-2021-10170

Name of the Vulnerable Software and Affected Versions: qinggan phpok version 5.1 Description: An issue was discovered in the edit save f function in framework/admin/tpl control.php, allowing attackers to write arbitrary files or get a shell. Recommendations: For qinggan phpok version 5.1, conside...