513 matches found
Made vesta 安全漏洞
Made vesta is a Made open source application. Made vesta version 0.9.8-24 contains a file inclusion vulnerability, which stems from a lack of filtering and restriction on file references in the web/add/user/index.php file, and can be exploited by attackers to cause file inclusion...
PT-2021-23918
Name of the Vulnerable Software and Affected Versions: vesta version 0.9.8-24 Description: The issue is related to a file inclusion vulnerability in the file web/add/user/index.php. This vulnerability may allow an attacker to include arbitrary files, potentially leading to code execution or other...
CVE-2021-43693: Undefined Security Weakness
vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php...
CVE-2021-40261
Multiple Cross Site Scripting XSS vulnerabilities exist in SourceCodester CASAP Automated Enrollment System 1.0 via the 1 userusername and 2 category parameters in saveclass.php, the 3 firstname, 4 class, and 5 status parameters in studenttable.php, the 6 category and 7 classname parameters in...
GHSA-WC73-W5R9-X9PC Cross-site Scripting in XXL-JOB
XXL-JOB 2.2.0 allows Stored XSS in Add User to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java...
CVE-2021-41916
A Cross-Site Request Forgery CSRF vulnerability in webTareas version 2.4 and earlier allows a remote attacker to create a new administrative profile and add a new user to the new profile. without the victim's knowledge, by enticing an authenticated admin user to visit an attacker's web page...
PT-2021-23449
Name of the Vulnerable Software and Affected Versions webTareas versions 2.4 and earlier Description A Cross-Site Request Forgery CSRF issue allows a remote attacker to create a new administrative profile and add a new user to the new profile without the victim's knowledge. This can be achieved b...
CVE-2021-38149
index.php/admin/adduser in Chikitsa Patient Management System 2.0.0 allows XSS...
PT-2021-4035
Name of the Vulnerable Software and Affected Versions Chikitsa Patient Management System version 2.0.0 Description The issue is related to a lack of protection measures for the web page structure, which can be exploited by a remote attacker to impact the confidentiality and integrity of protected...
Webmin 跨站请求伪造漏洞
Webmin is a Web-based system configuration tool for Unix-like systems, and the latest version can also be installed and run on Windows. A cross-site request forgery vulnerability exists in Webmin version 1.973. An attacker can use this vulnerability to create an elevated privilege user via Webmin...
Eaton Intelligent Power Manager SQL注入漏洞
Eaton Intelligent Power Manager IPM is an intelligent power manager from Eaton Corporation that supports remote monitoring and management of multiple devices in a network from an interface. An SQL injection vulnerability exists in Eaton Intelligent Power Manager versions prior to 1.69, which is...
bloofoxCMS 0.5.2.1 Cross Site Request Forgery
Title: bloofoxCMS 0.5.2.1 - CSRF Add user Exploit Author: LiPeiYi Date: 2020-12-18 Vendor Homepage: https://www.bloofox.com/ Software Link: https://github.com/alexlang24/bloofoxCMS/releases/tag/0.5.2.1 Version: 0.5.1.0 -.5.2.1 Tested on: windows 10 Desc: The application interface allows users to...
bloofoxCMS 0.5.2.1 - CSRF (Add user)
Title: bloofoxCMS 0.5.2.1 - CSRF Add user Exploit Author: LiPeiYi Date: 2020-12-18 Vendor Homepage: https://www.bloofox.com/ Software Link: https://github.com/alexlang24/bloofoxCMS/releases/tag/0.5.2.1 Version: 0.5.1.0 -.5.2.1 Tested on: windows 10 Desc: The application interface allows users to...
CVE-2020-29204
XXL-JOB 2.2.0 allows Stored XSS in Add User to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java...
CVE-2020-29204
CVE-2020-29204 affects XXL-JOB 2.2.0 with a Stored XSS in the Add User path. The root cause is a bypass of the 20-character limit in xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java, enabling persistent script injection. The NVD and related sources classify the CVSS v3...
CVE-2020-29204
XXL-JOB 2.2.0 allows Stored XSS in Add User to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java...
CVE-2020-29204: Improper Neutralization of Input During Web Page Generation
XXL-JOB 2.2.0 allows Stored XSS in Add User to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java...
XXL-JOB 跨站脚本漏洞
XXL-JOB is a distributed task scheduling platform whose core design goals are rapid development, simple learning, lightweight and easy to extend. A stored cross-site scripting vulnerability exists in XXL-JOB 2.2.0 in the "Add User" section, which can be exploited to bypass a 20-minute vulnerabili...
PT-2020-17110
Name of the Vulnerable Software and Affected Versions XXL-JOB version 2.2.0 Description The issue allows Stored XSS in the Add User feature, bypassing the 20-character limit via the UserController.java file in xxl-job-admin. This can be exploited through the...