Beauty Parlour Management System search-appointment.php Cross-Site Scripting Vulnerability

Beauty Parlour Management System is a software system for standardizing salon business processes and improving management efficiency. Beauty Parlour Management System suffers from a cross-site scripting vulnerability that originates from a cross-site scripting vulnerability in...

Mailcow Mail Server Flaws Expose Servers to Remote Code Execution

Two security vulnerabilities have been disclosed in the Mailcow open-source mail server suite that could be exploited by malicious actors to achieve arbitrary code execution on susceptible instances. Both shortcomings impact all versions of the software prior to version 2024-04, which was release...

CVE-2024-37798

Cross-site scripting XSS vulnerability in search-appointment.php in the Admin Panel in Phpgurukul Beauty Parlour Management System 1.0 allows remote attackers to inject arbitrary web script or HTML via the search input field...

CVE-2024-37798

Cross-site scripting XSS vulnerability in search-appointment.php in the Admin Panel in Phpgurukul Beauty Parlour Management System 1.0 allows remote attackers to inject arbitrary web script or HTML via the search input field...

PHPGurukul Beauty Parlour Management System 安全漏洞

Beauty Parlour Management System is a software system for standardizing salon business processes and improving management efficiency. Beauty Parlour Management System suffers from a cross-site scripting vulnerability that originates from a cross-site scripting vulnerability in...

CVE-2024-37798

Cross-site scripting XSS vulnerability in search-appointment.php in the Admin Panel in Phpgurukul Beauty Parlour Management System 1.0 allows remote attackers to inject arbitrary web script or HTML via the search input field...

PT-2024-27756 · Unknown · Phpgurukul Beauty Parlour Management System

Name of the Vulnerable Software and Affected Versions: Phpgurukul Beauty Parlour Management System version 1.0 Description: The issue is related to a cross-site scripting XSS vulnerability in the search-appointment.php file within the Admin Panel. This vulnerability allows remote attackers to...

Best Online News Portal SQL Injection Vulnerability

Best online news portal is an online news portal by Mayuri K. Individual developer. A SQL injection vulnerability exists in SourceCodester Best Online News Portal version 1.0, which originates when /admin/index.php contains some unknown functions that cause SQL injection via the parameter usernam...

Quick Cart 6.7 Shell Upload Vulnerability

Quick Cart version 6.7 suffers from a remote shell upload vulnerability provided you have administrative privileges. Title : Authenticated Remote Code Execution & Shell Upload Product : Quick Cart Vendor : https://opensolution.org/ Affected Version : 6.7 Researcher : Eagle Eye Tested on : Window ...

GHSA-6J89-FRXC-Q26M @strapi/plugin-content-manager leaks data via relations via the Admin Panel

Summary 1. If a super admin creates a collection where an item in the collection has an association to another collection, a user with the Author Role can see the list of associated items they did not create. They should only see their own items that they created, not all items ever created...

CVE-2024-29181 @strapi/plugin-content-manager leaks data via relations via the Admin Panel

Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create...

CVE-2024-1576

SQL Injection vulnerability in MegaBIP software allows attacker to obtain site administrator privileges, including access to the administration panel and the ability to change the administrator password. This issue affects MegaBIP software versions through 5.09...

MegaBIP Security Vulnerabilities

MegaBIP is a software used to create BIP websites. A security vulnerability exists in MegaBIP 5.09 and earlier versions that stems from the presence of a SQL injection vulnerability that allows an attacker to gain site administrator privileges, including access to the administration panel and the...

PT-2024-18144 · Megabip · Megabip

Name of the Vulnerable Software and Affected Versions: MegaBIP software versions through 5.09 MegaBIP software all versions Description: The issue allows an attacker to obtain site administrator privileges, including access to the administration panel and the ability to change the administrator...

GHSA-MHJ4-VRCV-X4XC nukeviet Deserialization of Untrusted Data vulnerability

nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/download.php and /admin/extensions/upload.php...

WP Chat App < 3.6.5 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed. 1. Navigate to http://vulnerable-site.tld/wp-admin/admin.php?page=ntawhatsappfloatingwidg...

CVE-2024-36667

CVE-2024-36667 affects idccms v1.35 and is a Cross-Site Request Forgery (CSRF) vulnerability in the admin endpoint /admin/idcProType_deal.php?mudi=add&nohrefStr=close. The issue enables unauthorized actions to be performed in the context of a logged-in user (impacting confidentiality, integrity a...

Privilege Escalation in TYPO3 CMS

The workspace/ version preview link created by a privileged backend user could be abused to obtain certain editing permission, if the admin panel is configured to be shown. A valid preview link is required to exploit this vulnerability...

GHSA-V5JP-4H2P-J2P4 Privilege Escalation in TYPO3 CMS

The workspace/ version preview link created by a privileged backend user could be abused to obtain certain editing permission, if the admin panel is configured to be shown. A valid preview link is required to exploit this vulnerability...

Cross-site Scripting (XSS)

org.opencms:opencms-core is vulnerable to Cross-site Scripting XSS. The vulnerability is due to insufficient input validation in the "title" field, allowing users with sufficient privileges to insert and execute malicious JavaScript code through the admin panel...