549 matches found
CVE-2025-50904
There is an authentication bypass vulnerability in WinterChenS my-site thru commit 6c79286 2025-06-11. An attacker can exploit this vulnerability to access /admin/ API without any token...
CVE-2024-57154
Incorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted payload to /admin/auth/index...
PT-2025-34134 · Winterchens · My-Site
Name of the Vulnerable Software and Affected Versions: WinterChenS my-site versions through commit 6c79286 2025-06-11 Description: An authentication bypass allows unauthorized access to the /admin/ API without a token. Recommendations: Versions prior to commit 6c79286 2025-06-11 should be updated...
📄 nopCommerce 4.10 / 4.80.3 Session Invalidation
nopCommerce versions 4.10 and 4.80.3 are vulnerable to insufficient invalidation of session cookies. The application does not properly invalidate or expire authentication cookies after logout or session termination. nopCommerce v4.10 and 4.80.3 is vulnerable to Insufficient Invalidation of Sessio...
HortusFox 安全漏洞
HortusFox is a free and open source self-hosted plant manager system from HortusFox, Inc. A security vulnerability exists in HortusFox v4.4 that stems from a cross-site scripting attack due to misuse of the parameter email in the /controller/admin.php endpoint...
CVE-2025-45315
A cross-site scripting XSS vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the email parameter...
PT-2025-33051 · Unknown · Hortusfox-Web
Name of the Vulnerable Software and Affected Versions: hortusfox-web version 4.4 Description: A cross-site scripting XSS issue exists in the /controller/admin.php API endpoint of hortusfox-web version 4.4. Attackers can execute arbitrary JavaScript in a user's browser by injecting a crafted paylo...
CVE-2025-45315
A cross-site scripting XSS vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the email parameter...
Cisco ISE 3.0 - Authorization Bypass
Exploit Title: Cisco ISE 3.0 - Authorization Bypass Exploit Author: @ibrahimsql ibrahimsql.com Exploit Author's github: https://github.com/ibrahmsql Description: Cisco ISE API Authorization Bypass CVE: CVE-2025-20125 Vendor Homepage: https://www.cisco.com/ Requirements: requests=2.25.0,...
CVE-2025-44139
Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=uploadzip...
CVE-2025-54768
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to download logs from the appliance configuration, exposing sensitive information...
📄 Xorux XorMon-NG 1.8 Privilege Escalation
Xorux XorMon-NG versions 1.8 and below has an API endpoint that should be limited to web application administrators. It is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control t...
CVE-2025-7749
A vulnerability, which was classified as critical, has been found in code-projects Online Appointment Booking System 1.0. This issue affects some unknown processing of the file /admin/getmanagerregion.php. The manipulation of the argument city leads to sql injection. The attack may be initiated...
Incorrect Privilege Assignment
Overview Affected versions of this package are vulnerable to Incorrect Privilege Assignment via the install process in the Add New Themes Page. An attacker can gain unauthorized access to restricted actions by exploiting insufficient privilege checks in the /admin-cp/theme/install endpoint...
CVE-2025-6212
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database module in versions 3.5.11 to 3.5.19 due to insufficient input sanitization and output escaping. The unfiltered field names are stored alongside the sanitized values. Later, the...
CVE-2024-42628
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/?/snippet/edit/3...
CVE-2024-45933
OnlineNewsSite v1.0 is vulnerable to Cross Site Scripting XSS which allows attackers to execute arbitrary code via the Title and summary fields in the /admin/post/edit/ endpoint...
CVE-2024-40322
An issue was discovered in JFinalCMS v.5.0.0. There is a SQL injection vulnerablity via /admin/divdata/data...