CVE-2024-34349 Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel

Sylius is an open source eCommerce platform. Prior to 1.12.16 and 1.13.1, there is a possibility to execute javascript code in the Admin panel. In order to perform an XSS attack input a script into Name field in which of the resources: Taxons, Products, Product Options or Product Variants. The co...

CVE-2024-34349 Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel

Sylius is an open source eCommerce platform. Prior to 1.12.16 and 1.13.1, there is a possibility to execute javascript code in the Admin panel. In order to perform an XSS attack input a script into Name field in which of the resources: Taxons, Products, Product Options or Product Variants. The co...

CVE-2024-34349 Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel

Sylius is an open source eCommerce platform. Prior to 1.12.16 and 1.13.1, there is a possibility to execute javascript code in the Admin panel. In order to perform an XSS attack input a script into Name field in which of the resources: Taxons, Products, Product Options or Product Variants. The co...

PT-2024-25805 · Sylius · Sylius

Name of the Vulnerable Software and Affected Versions: Sylius versions prior to 1.12.16 and 1.13.1 Description: There is a possibility to execute javascript code in the Admin panel. To perform an XSS attack, input a script into the Name field in which of the resources: Taxons, Products, Product...

CVE-2024-33829

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/readDeal.php?mudi=updateWebCache...

SOPlanning 1.52.00 Cross Site Request Forgery

/ !-- Update the following field to change the admins password to the...

SOPlanning 1.52.00 Cross Site Request Forgery Vulnerability

/...

The vulnerability of the update_form() function in the Admin Bar Editor plugin of the WordPress content management system allows a hacker to enable or disable the administrator panel on the website’s external interface.

The vulnerability of the updateform function in the Admin Bar Editor plugin of the WordPress content management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to enable or disable the administrator panel on the website’s...

CVE-2024-31547

Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/item/viewitem.php...

CVE-2024-22179

The application is vulnerable to an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving her access to the admin panel. Also vulnerable to account takeover and arbitrary password change...

CVE-2024-22179 Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data

The application is vulnerable to an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving her access to the admin panel. Also vulnerable to account takeover and arbitrary password change...

CVE-2024-22179 Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data

The application is vulnerable to an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving her access to the admin panel. Also vulnerable to account takeover and arbitrary password change...

CVE-2024-22179

CVE-2024-22179 affects Electrolink FM/DAB/TV Transmitter family (10W/100W/250W Compact DAB; 500W–30kW DAB; Compact FM; Modular FM; Digital FM; BI/BIII VHF; UHF TV). Root cause: unauthenticated parameter manipulation that lets an attacker set credentials to blank, gaining admin panel access and en...

Online Fire Reporting System 1.2 SQL Injection

Exploit Title: Online Fire Reporting System SQL Injection Authentication Bypass Date: 02/10/2024 Exploit Author: Diyar Saadi Vendor Homepage: https://phpgurukul.com/online-fire-reporting-system-using-php-and-mysql/ Software Link:...

VulnCheck KEV: CVE-2024-20767

Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel...

Virtuozzo Hybrid Infrastructure 6.1 Hotfix 1 (6.1.0-247)

In this release, Virtuozzo Hybrid Infrastructure enables selective updates of specific Kubernetes node groups, as well as provides stability and performance improvements. Vulnerability id: VSTOR-83526 Cannot filter backup plans by using the "Disabled" status. Vulnerability id: VSTOR-83662 Added...

CVE-2024-31204 mailcow Cross-site Scripting Vulnerability via Exception Handler

mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability resides in the exception handling mechanism, specifically when not operating in DEVMODE. The system saves...

CVE-2024-31204 mailcow Cross-site Scripting Vulnerability via Exception Handler

mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability resides in the exception handling mechanism, specifically when not operating in DEVMODE. The system saves...

CVE-2024-30248

Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin...

SVG Injection

piccoloadmin is vulnerable to SVG Injection. This vulnerability due to insufficient input validation and improper handling of SVG files within Piccolo's admin panel, allowing attackers to upload a malicious SVG file, which, when loaded under certain contexts, permits arbitrary access to the admin...