2643 matches found
CVE-2024-12171
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'ehcrmagentadduser' AJAX action in all versions up to, and including, 3.2.6. This makes it possible for authenticated attackers, with...
Exploit for Stack-based Buffer Overflow in Ivanti Connect_Secure
PoC for CVE-2025-0282 Remote Unauthenticated Stack Buffer O...
CVE-2025-23044
PwnDoc (pwndoc) is affected by a CSRF vulnerability due to missing protection and SameSite cookies, enabling cross-site requests on behalf of authenticated users. The issue is associated with the project commit 14acb704891245bf1703ce6296d62112e85aa995, which patches the vulnerability. Public desc...
CVE-2025-23044 Cross-Site Request Forgery (CSRF) allows creating admin account with POST request
PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit...
CVE-2025-23044 Cross-Site Request Forgery (CSRF) allows creating admin account with POST request
PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit...
CVE-2024-46908
In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user at least Report Viewer permissions required to achieve privilege escalation to the admin account...
CVE-2024-46906
In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user at least Report Viewer permissions required to achieve privilege escalation to the admin account...
CVE-2024-46905
In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated lower-privileged user at least Network Manager permissions required to achieve privilege escalation to the admin account...
CVE-2024-46905 WhatsUp Gold GetOrderByClause SQL Injection Privilege Escalation Vulnerability
In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated lower-privileged user at least Network Manager permissions required to achieve privilege escalation to the admin account...
CVE-2024-46906 WhatsUp Gold GetSqlWhereClause SQL Injection Privilege Escalation Vulnerability
In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user at least Report Viewer permissions required to achieve privilege escalation to the admin account...
CVE-2024-46907 WhatsUp Gold GetFilterCriteria SQL Injection Privilege Escalation Vulnerability
In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user at least Report Viewer permissions required to achieve privilege escalation to the admin account...
CVE-2024-46908 WhatsUp Gold GetFilterCriteria SQL Injection Privilege Escalation Vulnerability
In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user at least Report Viewer permissions required to achieve privilege escalation to the admin account...
CVE-2024-52323 Sensitive Data Exposure
Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin account...
CVE-2024-52323 Sensitive Data Exposure
Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin account...
PT-2024-39954 · WordPress · Wpgym
Name of the Vulnerable Software and Affected Versions: WPGYM - Wordpress Gym Management System plugin versions up to, and including, 67.1.0 Description: The issue is related to a missing capability check on the MJ gmgt add staff member function, which allows authenticated attackers with...
The vulnerability in the admin_account.cgi script of Netgear R8500’s integrated routing software allows a hacker to execute arbitrary commands.
The vulnerability of the adminaccount.cgi microprogramming system in Netgear R8500 routers exists due to the failure to take measures to neutralize special elements used in the operating system’s command for processing the sysNewPasswd parameter. Exploiting this vulnerability allows a malicious...
CVE-2021-1462
A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to elevate privileges on an affected system. To exploit this vulnerability, an attacker would need to have a valid Administrator account on an affected system. The vulnerability is due to...
CVE-2024-0787
phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded-For' header. The issue lies in the 'getuserip' function in 'class.Common.php' at lines 1044 and 1045, where the presence of the...
CVE-2024-0787 Improper Restriction of Excessive Authentication Attempts in phpipam/phpipam
phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded-For' header. The issue lies in the 'getuserip' function in 'class.Common.php' at lines 1044 and 1045, where the presence of the...
CVE-2024-0787 Improper Restriction of Excessive Authentication Attempts in phpipam/phpipam
phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded-For' header. The issue lies in the 'getuserip' function in 'class.Common.php' at lines 1044 and 1045, where the presence of the...