81 matches found
CVE-2023-27088
feiqu-opensource Background Vertical authorization vulnerability exists in IndexController.java. demo users with low permission can perform operations within the permission of the admin super administrator and can use this vulnerability to change the blacklist IP address in the system at will...
Online Tours And Travels Management System SQL注入漏洞
Online Tours And Travels Management System is an online tour management system. v1.0 of Online Tours And Travels Management System is vulnerable to SQL injection, which originates from /admin/operations/tax. The tname parameter in php lacks validation for external input SQL statements. An attacke...
CVE-2022-32992
Online Tours And Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the tname parameter at /admin/operations/tax.php...
Sql injection
Online Tours And Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the tname parameter at /admin/operations/tax.php...
Online Tours And Travels Management System SQL注入漏洞
Online Tours And Travels Management System is an online tour management system. v1.0 of Online Tours And Travels Management System is vulnerable to SQL injection, which originates from /admin/operations/tax. The tname parameter in php lacks validation for external input SQL statements. An attacke...
Important: mailman
Issue Overview: Cross-site request forgery CSRF vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's...
mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover
A Cross-Site Request Forgery CSRF attack can be performed in mailman due to a CSRF token bypass. CSRF tokens are not checked against the right type of user when performing admin operations and a token created by a regular user can be used by an admin to perform an admin-level request, effectively...
CVE-2020-17533
Summary of CVE-2020-17533 (Apache Accumulo) Root cause: Insufficient verification of the return values from policy-enforcement functions canFlush and canPerformSystemActions, allowing an authenticated user with limited permissions to perform restricted administrative operations. Affected versions...
Weak Password Vulnerability in the Backend of NetSense SecBMS 3600 Bandwidth Management System
NetShen Information Technology Beijing Co., Ltd. specializes in network and information security. A weak password vulnerability exists in the backend of NetShen SecBMS 3600 Bandwidth Management System, which can be exploited by an attacker to log in to the system with a weak password and perform...
Input validation
Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted...
CVE-2020-11532
Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to bypass authentication for this server and execute all operations in the context of admin user...
CVE-2020-11532
Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to bypass authentication for this server and execute all operations in the context of admin user...
Path traversal
Path Traversal in admin/imagepaster/operations.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete any folder on the webserver using a dot-dot-slash sequence ../ via the GET parameter crdir, when the GET parameter action is set to df, causing a Denial of Service...
CMSsite 1.0 Cross Site Request Forgery Vulnerability
Exploit for php platform in category web applications Exploit Title: CMSsite 1.0 - Cross-Site Request Forgery Delete Admin Exploit Author: Mr Winst0n Author E-mail: [email protected] Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link :...
The vulnerability of Siemens TIM’s switching module’s microprogramming software lies in the lack of authentication for the critical network service function at port 102/TCP. This allows attackers to perform arbitrary administrative operations.
The vulnerability of Siemens TIM’s communication module’s microprogramming software is related to the lack of authentication for the critical network service function at port 102/TCP. Exploiting this vulnerability allows a perpetrator to perform arbitrary administrative operations...
Design/Logic Flaw
IBM Security Access Manager Appliance 9.0.3.1, 9.0.4.0 and 9.0.5.0 could allow unauthorized administration operations when Advanced Access Control services are running. IBM X-Force ID: 150998...
CVE-2018-15193
A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link...
CVE-2018-15193
A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link...
