423 matches found
PT-2023-16339 · Sourcecodester · Sourcecodester Online Tours & Travels Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Online Tours & Travels Management System version 1.0 Description: A critical issue has been found in the system, affecting some unknown functionality of the file admin/expense report.php. The manipulation of the from date...
Online Food Ordering System SQL注入漏洞
Online Food Ordering System is an online food ordering system. an SQL injection vulnerability exists in Online Food Ordering System, which stems from a problem in the unknown section of the file adminclass.php, where an operation on the parameter email can lead to sql injection. No details of the...
CVE-2022-44401
Online Tours & Travels Management System v1.0 contains an arbitrary file upload vulnerability via /tour/admin/file.php...
Online Tours & Travels Management System 代码问题漏洞
Online Tours & Travels Management System is an online tour management system by Mayuri K. Individual developer. A code issue vulnerability exists in Online Tours & Travels Management System v1.0, which was discovered to contain a file upload vulnerability via /tour/admin/file.php...
PT-2022-23929 · Unknown · Sourcecodester Web-Based Student Clearance System
Name of the Vulnerable Software and Affected Versions: SourceCodester Web-Based Student Clearance System affected versions not specified Description: A critical issue has been discovered, affecting an unknown part of the file Admin/edit-admin.php. The manipulation of the id argument leads to SQL...
CVE-2022-41406
An arbitrary file upload vulnerability in the /admin/adminpic.php component of Church Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...
PT-2022-23819 · Bluecms · Bluecms
Name of the Vulnerable Software and Affected Versions: BlueCMS version 1.6 Description: The issue is related to SQL injection, specifically located in line 132 of the admin/article.php file. Recommendations: For BlueCMS version 1.6, update the admin/article.php file to fix the SQL injection issue...
CVE-2017-20067 Hindu Matrimonial Script sql injection
A vulnerability was found in Hindu Matrimonial Script. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/. The manipulation of the argument username/password with the input 'or''=' leads to sql injection. The attack can be launched...
Magento affected by remote code execution via a file upload
Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution...
CVE-2022-28997
CSZCMS v1.3.0 allows attackers to execute a Server-Side Request Forgery SSRF which can be leveraged to leak sensitive data via a local file inclusion at /admin/filemanager/connector/...
CVE-2022-1273
The Import WP WordPress plugin before 2.4.6 does not validate the imported file in some cases, allowing high privilege users such as admin to upload arbitrary files such as PHP, leading to RCE...
WordPress plugin 跨站脚本漏洞
WordPress is a blogging platform developed using the PHP language. WordPress plugin WP YouTube Live 1.7.21 and previous versions are vulnerable to a cross-site scripting vulnerability, which stems from the plugin being vulnerable to a reflected cross-site scripting attack via POST data in the...
PT-2022-13747 · Sap · Sap Information System
Name of the Vulnerable Software and Affected Versions: SAP Information System version 1.0 Description: A critical issue was found, allowing an unauthenticated attacker to create a new admin account for the web application with a simple POST request to the "add admin.php" file, located at the "/SA...
Aseco Lietuva document management system DVS Avilys 日志信息泄露漏洞
Aseco Lietuva document management system DVS Avilys is a document and process management system from Aseco Poland. Aseco Lietuva document management system DVS Avilys A log message disclosure vulnerability exists in versions prior to 2022-03-10, which stems from the reporting module allowing...
CVE-2021-44673
A Remote Code Execution RCE vulnerability exists in Croogo 3.0.2via admin/file-manager/attachments, which lets a malicoius user upload a web shell script...
Remote code execution
A Remote Code Execution RCE vulnerability exists in Croogo 3.0.2via admin/file-manager/attachments, which lets a malicoius user upload a web shell script...
CVE-2021-44673
A Remote Code Execution RCE vulnerability exists in Croogo 3.0.2via admin/file-manager/attachments, which lets a malicoius user upload a web shell script...
Croogo 代码问题漏洞
Croogo is a content management system CMS based on the CakePHP framework development . The system provides content type can be customized as Blog, Node, Page, content editing using WYSIWYG editor and other features. A security vulnerability exists in Croogo 3.0.2, which can be exploited to allow...
WordPress Orange Form Plugin SQL Injection Vulnerability
WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. A SQL injection vulnerability exists in the Wordpress Orange Form Plugin 1.0 and earlier versions, which originates in the product admin/orange-form-email.php file in the processbulkaction functi...