PT-2024-1795 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be abused by an admin attacker to inject malicious scripts into every admin page...

Design/Logic Flaw

The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the seedprodlitenewlpage function in all versions up to, and including, 6.15.21...

CVE-2022-2413

The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pages, allowing a logged in user with roles as low as Author to inject a javascript payload into the slide title even when the unfilteredhtml capability is...

Design/Logic Flaw

The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pages, allowing a logged in user with roles as low as Author to inject a javascript payload into the slide title even when the unfilteredhtml capability is...

CVE-2022-2413 Slide Anything < 2.3.47 - Author+ Cross Site Scripting in slide title

The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pages, allowing a logged in user with roles as low as Author to inject a javascript payload into the slide title even when the unfilteredhtml capability is...

CVE-2022-2413

The CVE-2022-2413 issue affects the Slide Anything WordPress plugin prior to 2.3.47. Root cause: the slide title is not properly sanitized/escaped before output in admin pages, enabling a logged-in user with roles as low as Author to inject JavaScript payloads. Impact: cross-site scripting in adm...

PT-2024-15641 · Cxbsoft · Cxbsoft Post-Office

Name of the Vulnerable Software and Affected Versions: CXBSoft Post-Office version 1.0 Description: A critical issue was found in the HTTP POST Request Handler component, specifically in the /admin/pages/update go.php file. The manipulation of the version argument leads to sql injection. The issu...

Sql injection

A vulnerability was found in code-projects Fighting Cock Information System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/pages/editchicken.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The...

Fighting Cock Information System SQL Injection Vulnerability

Fighting Cock Information System is a chicken information system by chrisjelo individual developer. code-projects Fighting Cock Information System version 1.0 has a SQL injection vulnerability that originates from a SQL injection vulnerability in the file /admin/pages/editchicken.php...

Faculty Management System SQL Injection Vulnerability

Faculty Management System is a code-projects open source faculty management system. code-projects Faculty Management System version 1.0 SQL injection vulnerability , the vulnerability stems from /admin/pages/student-print.php file has a SQL injection vulnerability...

CVE-2023-50175

Stored cross-site scripting vulnerability exists in the App Settings /admin/app page, the Markdown Settings /admin/markdown page, and the Customize /admin/customize page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser o...

CVE-2023-7057

A vulnerability, which was classified as problematic, has been found in code-projects Faculty Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/pages/yearlevel.php. The manipulation of the argument Year Level/Section leads to cross site scripting. The...

PT-2023-32857 · Code Projects · Faculty Management System

Name of the Vulnerable Software and Affected Versions: code-projects Faculty Management System version 1.0 Description: A problematic issue was found in the Faculty Management System, affecting an unknown functionality of the file /admin/pages/subjects.php. The manipulation of the Description/Uni...

Faculty Management System Cross-Site Scripting Vulnerability

Faculty Management System is an open source faculty management system from code-projects. Faculty Management System suffers from a cross-site scripting vulnerability that originates from /admin/pages/yearlevel.php may lead to cross-site scripting...

PT-2023-31436 · Unknown · Customer Support System

Name of the Vulnerable Software and Affected Versions: Customer Support System version v1 Description: The issue is related to incorrect access control, allowing non-administrator users to access administrative pages and execute actions that are supposed to be reserved for administrators...

Wing FTP Server Detection (HTTP)

HTTP based detection of Wing FTP Server. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.126600";...

CVE-2023-5979

The eCommerce Product Catalog Plugin for WordPress plugin before 3.3.26 does not have CSRF checks in some of its admin pages, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as delete all products...

PT-2023-32457 · WordPress · Ecommerce Product Catalog Plugin

Name of the Vulnerable Software and Affected Versions: eCommerce Product Catalog Plugin for WordPress versions prior to 3.3.26 Description: The issue is related to the lack of CSRF checks in some admin pages of the plugin, which could allow attackers to make logged-in users perform unwanted actio...

DRUPAL-CONTRIB-2023-037

This module enables you to build administrative pages for managing configuration objects, which may then be used elsewhere in the site. The module doesn't sufficiently validate access when the JSONAPI module is also installed. This vulnerability is mitigated by the fact that it only affects sites...

CVE-2023-2761

The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the txtsearch parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin...