508 matches found
WellCMS 跨站请求伪造漏洞
WellCMS is an open source, billion-load, mobile-leaning, lightweight, super-responsive, high-load CMS that is the best choice for large data volumes and high concurrent access websites. Users - Create User - Add New User does not sufficiently verify that the request is from a trusted user. An...
CVE-2022-2745 SourceCodester Gym Management System Add New Trainer add_trainers.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Gym Management System. This affects an unknown part of the file /admin/addtrainers.php of the component Add New Trainer. The manipulation of the argument trainername leads to sql injection. It is possible to initiate t...
CVE-2022-2745: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in SourceCodester Gym Management System. This affects an unknown part of the file /admin/addtrainers.php of the component Add New Trainer. The manipulation of the argument trainername leads to sql injection. It is possible to initiate t...
CVE-2022-21178
An os command injection vulnerability exists in the confsrv ucloudaddnewnode functionality of TCL LinkHub Mesh Wifi MS1G0001.0014. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a malicious packet to trigger this vulnerability...
CVE-2022-32114: Unrestricted Upload of File with Dangerous Type
An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create upload" permission is supposed to be able to upload PDF fil...
OrangeHRM 跨站脚本漏洞
OrangeHRM is a human resource management system HRM from OrangeHRM USA. The system supports personnel information management, leave management, time and attendance management and recruitment management, etc. A cross-site scripting vulnerability exists in OrangeHRM v4.10.1, which stems from a lack...
Canvs Canvas Cross-site Scripting (XSS) via title and content fields
cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts Add New" action, and during creation of new tags and users...
GHSA-3657-Q433-MMPX Canvs Canvas Cross-site Scripting (XSS) via title and content fields
cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts Add New" action, and during creation of new tags and users...
MyBB 1.8.29 - MyBB 1.8.29 - Remote Code Execution (Authenticated) Exploit
Exploit Title: MyBB 1.8.29 - Remote Code Execution RCE Authenticated Exploit Author: Altelus Vendor Homepage: https://mybb.com/ Software Link: https://github.com/mybb/mybb/releases/tag/mybb1829 Version: MyBB 1.8.29 Tested on: Linux CVE : CVE-2022-24734 An RCE can be obtained on MyBB's Admin CP in...
MyBB 1.8.29 Remote Code Execution
Exploit Title: MyBB 1.8.29 - Remote Code Execution RCE Authenticated Date: 2022-05-08 Exploit Author: Altelus Vendor Homepage: https://mybb.com/ Software Link: https://github.com/mybb/mybb/releases/tag/mybb1829 Version: MyBB 1.8.29 Tested on: Linux CVE : CVE-2022-24734 An RCE can be obtained on...
CVE-2021-43712
Stored XSS in Add New Employee Form in Sourcecodester Employee Daily Task Management System 1.0 Allows Remote Attacker to Inject/Store Arbitrary Code via the Name Field...
Cross site scripting
Stored XSS in Add New Employee Form in Sourcecodester Employee Daily Task Management System 1.0 Allows Remote Attacker to Inject/Store Arbitrary Code via the Name Field...
CVE-2021-43712
CVE-2021-43712 corresponds to a Stored XSS vulnerability in Sourcecodester’s Employee Daily Task Management System v1.0, occurring in the Add New Employee Form Name field. The incident is described across multiple sources as enabling a remote attacker to inject/store arbitrary code via the Name f...
CVE-2021-43712: Improper Neutralization of Input During Web Page Generation
Stored XSS in Add New Employee Form in Sourcecodester Employee Daily Task Management System 1.0 Allows Remote Attacker to Inject/Store Arbitrary Code via the Name Field...
CVE-2022-28589
A stored cross-site scripting XSS vulnerability in Pixelimity 1.0 allows attackers to execute arbitrary web scripts or HTML via the Title field in admin/pages.php?action=addnew...
PT-2022-19095
Name of the Vulnerable Software and Affected Versions Pixelimity version 1.0 Description A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via the Title field in the "admin/pages.php?action=add new" endpoint. This enables attackers to inject malicio...
Popup Maker < 1.16.5 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Popup Maker Create Popup Popup Settings Triggers Add New Cookie Add Cookie...
CVE-2021-43505
Multiple Cross Site Scripting XSS vulnerabilities exist in Ssourcecodester Simple Client Management System v1 via 1 Add new Client and 2 Add new invoice...