CVE-2026-10777 ealpha072 Student-Management-System Administrative Backend config.php improper authentication

A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. Affected by this issue is some unknown functionality of the file admin/config.php of the component Administrative Backend. Such manipulation leads to improper authentication. The...

CVE-2026-10777: Improper Authentication

A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. Affected by this issue is some unknown functionality of the file admin/config.php of the component Administrative Backend. Such manipulation leads to improper authentication. The...

CVE-2025-11331: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in IdeaCMS up to 1.8. The impacted element is an unknown function of the file app/common/logic/admin/Config.php of the component Website Name Handler. Performing manipulation of the argument 网站名称 results in command injection. The attack may be initiated remotely. The...

IdeaCMS 命令注入漏洞

IdeaCMS is an open source shopping mall system by IdeaCMS. A command injection vulnerability exists in IdeaCMS 1.8 and earlier versions, which stems from incorrect manipulation of the parameter site name in the file app/common/logic/admin/Config.php, which could lead to a command injection attack...

CVE-2025-0480

A vulnerability classified as problematic has been found in wuzhicms 4.1.0. This affects the function test of the file coreframe/app/search/admin/config.php. The manipulation of the argument sphinxhost/sphinxport leads to server-side request forgery. It is possible to initiate the attack remotely...

PT-2025-3911

Name of the Vulnerable Software and Affected Versions wuzhicms version 4.1.0 Description A problematic issue has been found in the function test of the file coreframe/app/search/admin/config.php. The manipulation of the sphinxhost/sphinxport argument leads to server-side request forgery. It is...

CVE-2025-0480: Server-Side Request Forgery (SSRF)

A vulnerability classified as problematic has been found in wuzhicms 4.1.0. This affects the function test of the file coreframe/app/search/admin/config.php. The manipulation of the argument sphinxhost/sphinxport leads to server-side request forgery. It is possible to initiate the attack remotely...

CVE-2024-1026: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Cogites eReserv 7.7.58 and classified as problematic. This issue affects some unknown processing of the file front/admin/config.php. The manipulation of the argument id with the input %22%3E%3Cscript%3Ealert%27XSS%27%3C/script%3E leads to cross site scripting. The...

CVE-2023-47444: Improper Control of Generation of Code

An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users having common/security write privilege can write arbitrary untrusted data inside config.php and admin/config.php, resulting in remote code execution on the underlying server...

CVE-2023-47444

An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users having common/security write privilege can write arbitrary untrusted data inside config.php and admin/config.php, resulting in remote code execution on the underlying server...

PT-2023-7435

Name of the Vulnerable Software and Affected Versions OpenCart versions 4.0.0.0 through 4.0.2.3 Description The issue allows authenticated backend users with common/security write privilege to write arbitrary untrusted data inside config.php and admin/config.php, resulting in remote code executio...

PT-2022-16306

Name of the Vulnerable Software and Affected Versions seacms version V11.5 Description The issue is related to an arbitrary code execution vulnerability in the admin config.php file. Recommendations For seacms version V11.5, consider restricting access to the admin config.php file until a patch i...

CVE-2019-19852

An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report screen in the cel module at the admin/config.php?display=cel URI via date fields. This affects cel through 13.0.26.9, 14.x through 14.0.2.14, and 15.x through 15.0.15.4...

CVE-2019-19851

An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Debug/Test page of the Superfecta module at the admin/config.php?display=superfecta URI. This affects Superfecta through 13.0.4.7, 14.x through 14.0.24, and 15.x through 15.0.2.20...

CVE-2019-19851

An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Debug/Test page of the Superfecta module at the admin/config.php?display=superfecta URI. This affects Superfecta through 13.0.4.7, 14.x through 14.0.24, and 15.x through 15.0.2.20...

PT-2020-10259

Name of the Vulnerable Software and Affected Versions Sangoma FreePBX and PBXact versions 13.0.0 through 13.0.4.7 Sangoma FreePBX and PBXact versions 14.0.0 through 14.0.24 Sangoma FreePBX and PBXact versions 15.0.0 through 15.0.2.20 Description An XSS Injection issue exists within the Debug/Test...

PT-2020-10202

Name of the Vulnerable Software and Affected Versions FreePBX versions 14.0.10.2 through 14.0.10.7 Description Multiple XSS vulnerabilities exist in the Backup & Restore module for FreePBX. An attacker can modify the id parameter of the backup configuration screen and embed malicious XSS code via...

PT-2020-10260

Name of the Vulnerable Software and Affected Versions Sangoma FreePBX and PBXact versions 13.0.0 through 13.0.26.9 Sangoma FreePBX and PBXact versions 14.0.0 through 14.0.2.14 Sangoma FreePBX and PBXact versions 15.0.0 through 15.0.15.4 Description An XSS Injection issue exists within the Call...

CVE-2019-19852: Improper Neutralization of Input During Web Page Generation

An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report screen in the cel module at the admin/config.php?display=cel URI via date fields. This affects cel through 13.0.26.9, 14.x through 14.0.2.14, and 15.x through 15.0.15.4...

CVE-2019-19851: Improper Neutralization of Input During Web Page Generation

An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Debug/Test page of the Superfecta module at the admin/config.php?display=superfecta URI. This affects Superfecta through 13.0.4.7, 14.x through 14.0.24, and 15.x through 15.0.2.20...