The administration panel of the Ivanti Sentry integrated mobile security firewall has vulnerabilities. These vulnerabilities allow a intruder to modify configurations, execute system commands, or write files to the system.

The vulnerability of the administration panel of the Ivanti Sentry integrated mobile security gateway is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to modify configurations, execute system commands, or write files to the syst...

CVE-2023-37421

Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack against an administrative user of the interface. A successful exploit allows an attacker to execute...

FastMatch Iddaa Tahmin Scripti 2.0 SQL Injection

==================================================================================================================================== | Title : FastMatch İddaa Tahmin Scripti v2.0 auth by pass vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefo...

URL Shortify < 1.7.6 - Unauthenticated Stored XSS via referer header

Description The plugin does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link. PoC 1. Add a new shortened link in the interface...

wpDataTables < 2.1.66 - Admin+ PHP Object Injection

Description The plugin does not validate the "Serialized PHP array" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is present on the server. This is impactful in environments where admin...

CVE-2023-2122

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowdtabsactive parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary...

CVE-2023-1977

The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network...

CVE-2023-1977

The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network...

CVE-2023-2122

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowdtabsactive parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary...

Server side request forgery (ssrf)

The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network...

CVE-2023-2122

The CVE-2023-2122 entry concerns the Image Optimizer by 10web WordPress plugin (versions up to 1.0.26). It is vulnerable to a reflected XSS via the iowd_tabs_active parameter, which is sanitized/escaped insufficiently before rendering in the plugin admin panel. Impact is that an attacker could lu...

DigaSell Digital Store PHP Script 1.0.0 SQL Injection

==================================================================================================================================== | Title : DigaSell - Digital store PHP Script V1.0.0 Blind Sql Injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser :...

CVE-2023-39112

ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel...

CVE-2023-39112

ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel...

CVE-2023-39112

ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel...

Arbitrary file deletion

ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel...

CVE-2023-39112

ECShop v4.1.16 has an arbitrary file deletion vulnerability in the Admin Panel (CVE-2023-39112). Public sources confirm the affected product/version and impact on integrity and availability, with CVSS 3.1 metrics: I:H, A:H, C:N; no details on root cause in the provided documents. No exploitation ...

PT-2023-26787 · Ecshop · Ecshop

Name of the Vulnerable Software and Affected Versions: ECShop version 4.1.16 Description: The issue is related to an arbitrary file deletion vulnerability in the Admin Panel. Recommendations: For ECShop version 4.1.16, at the moment, there is no information about a newer version that contains a f...

CVE-2023-39112

ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel...

ShopeX ECShop Authorization Issues Vulnerability

ShopeX ECShop is an open source mall system of the Chinese business school ShopeX company . Support PC + H5 + APP + small program mall , source code free download experience , suitable for enterprise development and build mall. ECShop v4.1.16 version of a security vulnerability , the vulnerabilit...