5001 matches found
The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request
POC: 1. go to signup form: http://127.0.0.1:8118/signup 2. Fill the Full Name input field with huge charactersmore than lakhs or crores 3. After created the account, check the admin panel: http://127.0.0.1:8118/accounts, go to Accounts -- customers 4. The admin panel will be flooded with our...
GHSA-QGRF-34HP-GHM9 OpenCart Path Traversal
OpenCart through 3.0.2.0 allows directory traversal in the editDownload function in admin\model\catalog\download.php via admin/index.php?route=catalog/download/edit, related to the downloadid. For example, an attacker can download ../../config.php...
Subrion Cross-site Scripting (XSS)
There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration...
GHSA-9738-C49Q-4RGC Subrion Cross-site Scripting (XSS)
There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration...
CVE-2022-30373
Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/cargotypes/managecargotype.php?id=...
Dolibarr arbitrary commands execution
The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads...
GHSA-6J62-M2VV-WC3M Dolibarr arbitrary commands execution
The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads...
Cyber Cafe Management System SQL Injection Vulnerability
Cyber Cafe Management System CCMS is an Internet cafe management system. version 1.0 of Cyber Cafe Management System Project is vulnerable to SQL injection, which stems from multiple SQL injection vulnerabilities in the username and password parameters in the administration panel. An attacker cou...
Merchandise Online Store SQL注入漏洞
Merchandise Online Store is a merchandise online store system. merchandise Online Store has a security vulnerability that can be exploited by attackers via /vloggersmerch/admin/?page=maintenance/managecategory& id= to conduct an SQL injection attack...
CVE-2022-29009
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Management System Project v1.0 allows attackers to bypass authentication...
CVE-2022-29009
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Management System Project v1.0 allows attackers to bypass authentication...
CVE-2022-29006
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Management System v1.0 allows attackers to bypass authentication...
CVE-2022-29006
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Management System v1.0 allows attackers to bypass authentication...
CVE-2022-29006
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Management System v1.0 allows attackers to bypass authentication...
CVE-2022-28078
Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting XSS vulnerability in the Admin panel via the $GET'page' parameter...
CVE-2022-28077
Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting XSS vulnerability in the Admin panel via the $GET's' parameter...
CVE-2022-28077
Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting XSS vulnerability in the Admin panel via the $GET's' parameter...
CVE-2022-28078
Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting XSS vulnerability in the Admin panel via the $GET'page' parameter...