CVE-2023-24364

Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter under the Admin Panel...

PT-2023-19529 · Unknown · Simple Customer Relationship Management System

Name of the Vulnerable Software and Affected Versions: Simple Customer Relationship Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the username parameter under the Admin Panel. Recommendations: For Simple...

Online Food Ordering System 代码问题漏洞

Online Food Ordering System is an online food ordering system by Carlo Montero, an individual developer. A security vulnerability exists in Online Food Ordering System version v2.0, which originates from an arbitrary file upload vulnerability in the component /fos/admin/ajax.php, which can be...

SQL Injection in Custom Fields

Description SQL injection when updating custom fields in the admin panel. Malicious web admins can use POST /app/admin/custom-fields/edit-result.php with parameters fieldType=set&fieldSize='1' CHARACTER SET utf8; SELECT sleep3; to execute the inserted SQL command SELECT sleep3; and thus result th...

stored Blind XSS in Admin Panel through FAQ-Proposal leads to Admin Full Account Takeover

Hello. Vulnerability: Blind XSS in Admin Panel while generating Report 1. Without beeing logged in the Application 2. Go to FAQ-Proposal - put an XSS Payload like alert'1' in the question Field 4. Send the Proposal ------ 4. Admin will login 5. The Proposal will pop up in the Category you specifi...

Watu Quiz < 3.3.8.2 - Reflected XSS

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Make a logged in admin open the following URL:...

KesionCMS X 1.5.160902 Insecure Settings

==================================================================================================================================== | Title : KesionCMS X 1.5.160902 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

CVE-2022-46956

Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/manageuser.php...

CMS Global-PC Technology 1.0 Insecure Settings

==================================================================================================================================== | Title : CMS Global-PC Technology v 1.0 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefo...

Eatself 1.1.5 SQL Injection

==================================================================================================================================== | Title : Eatself v1.1.5 Auth By Pass Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit | | Vend...

Stored XSS in Add new question

Description Stored cross-site scripting also known as second-order or persistent XSS arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way. steps 1-log in as an admin user first. 2-go to :...

CVE-2019-25092

A vulnerability classified as problematic was found in Nakiami Mellivora up to 2.1.x. Affected by this vulnerability is the function printuseriplog of the file include/layout/user.inc.php of the component Admin Panel. The manipulation of the argument $entry'ip' leads to cross site scripting. The...

CVE-2019-25092

A vulnerability classified as problematic was found in Nakiami Mellivora up to 2.1.x. Affected by this vulnerability is the function printuseriplog of the file include/layout/user.inc.php of the component Admin Panel. The manipulation of the argument $entry'ip' leads to cross site scripting. The...

Cross site scripting

A vulnerability classified as problematic was found in Nakiami Mellivora up to 2.1.x. Affected by this vulnerability is the function printuseriplog of the file include/layout/user.inc.php of the component Admin Panel. The manipulation of the argument $entry'ip' leads to cross site scripting. The...

CVE-2019-25092 Nakiami Mellivora Admin Panel user.inc.php print_user_ip_log cross site scripting

A vulnerability classified as problematic was found in Nakiami Mellivora up to 2.1.x. Affected by this vulnerability is the function printuseriplog of the file include/layout/user.inc.php of the component Admin Panel. The manipulation of the argument $entry'ip' leads to cross site scripting. The...

CVE-2019-25092 Nakiami Mellivora Admin Panel user.inc.php print_user_ip_log cross site scripting

A vulnerability classified as problematic was found in Nakiami Mellivora up to 2.1.x. Affected by this vulnerability is the function printuseriplog of the file include/layout/user.inc.php of the component Admin Panel. The manipulation of the argument $entry'ip' leads to cross site scripting. The...

CVE-2019-25092

The CVE-2019-25092 issue affects Nakiami Mellivora up to version 2.1.x, specifically the Admin Panel component’s function print_user_ip_log in include/layout/user.inc.php. The vulnerability arises from improper handling of the argument $entry['ip'], enabling cross-site scripting. It can be exploi...

PT-2022-8304 · Unknown · Nakiami Mellivora

Name of the Vulnerable Software and Affected Versions: Nakiami Mellivora versions up to 2.1.x Description: A problematic vulnerability was found in the Admin Panel component, specifically in the function print user ip log of the file include/layout/user.inc.php. The manipulation of the argument...

Stored XSS in admin panel (users page)

Description Stored XSS in admin panel in users page via inject XSS payload in Name input field by any user to affect the admin panel Proof of Concept https://drive.google.com/file/d/1EsYq3R6GRAdEbpZxp2RwQwGr4G8fJGB7/view?usp=sharing...

Stored XSS in FAQ comments

Description Stored XSS in FAQ comments by any visitor or anonymous user that alerted in admin panel in comments page also it stored in the FAQ page itself via injecting XSS payload in "Name " and "Message" input fields . Proof of Concept...