CVE-2022-23904

Rainworx Auctionworx 3.1R2 is vulnerable to a Cross-Site Request Forgery CSRF attack that allows an authenticated user to upgrade his account to admin and gain access to the auctionworx admin control panel. This vulnerability affects AuctionWorx Enterprise and AuctionWorx: Events Edition...

Subrion CMS Cross-site Scripting (XSS) vulnerability in the `contact us` plugin

A cross-site scripting XSS vulnerability exists in the contact us plugin for Subrion CMS = 4.2.1 version via List of subjects. This can be exploited by someone with administrative privileges when they log in to the admin panel...

CVE-2022-28102

A cross-site scripting XSS vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected at /edit-db.php...

Cross site scripting

A cross-site scripting XSS vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected at /edit-db.php...

CVE-2022-28102

A cross-site scripting (XSS) vulnerability affects PHP MySQL Admin Panel Generator v1, exploitable via a crafted payload injected at /edit-db.php. Impact is arbitrary web script/HTML execution. Remediation mentions disabling the /edit-db.php endpoint until a patch is available; monitor for updates.

CVE-2022-28102

A cross-site scripting XSS vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected at /edit-db.php...

PHP MySQL Admin Panel Generator 跨站脚本漏洞

PHP MySQL Admin Panel Generator is a PHP tool that helps you create PHP admin panels for any MySQL database in seconds. A security vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to execute arbitrary web script or HTML via a specially crafted payload injected in /edit-db.php...

Sourcecodester Baby Care System SQL注入漏洞（CNVD-2022-35536）

Sourcecodester Baby Care System is an application of the Sourcecodester community in the United States. Sourcecodester Baby Care System v1.0 is vulnerable to SQL injection, which originates from the lack of validation of external input SQL in the /admin.php?id=posts & action=display & value=1 &...

CVE-2022-28431

Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/siteoptions.php&social=remove&sid=2...

CVE-2022-28015

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\cashadvanceedit.php...

CVE-2022-28010

The CVE-2022-28010 entry affects Attendance and Payroll System v1.0, where a SQL injection vulnerability exists in the component admin/overtime_delete.php. The root cause is lack of input validation allowing external SQL statements to be executed, potentially exposing sensitive database data. Doc...

CVE-2022-28434

CVE-2022-28434 affects Baby Care System v1.0. A SQL injection vulnerability exists in admin.php, exploitable via parameters id=siteoptions, social=edit, sid (example sid=2). Multiple sources corroborate a database-input validation flaw leading to potential unauthorized SQL execution and data expo...

CVE-2022-28433

Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=display&value=Show&userid=...

VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File Upload

The plugin does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code Edit/add a Characteristics /wp-admin/admin.php?option=comvikbooking&task=carat and upload a fake GIF with PHP code in it as ...

UPS VDP: Broken access control

Summary: hello ups team ,,, I've found broken access control vulnerability in your sites It allows me to access the admin panel of the support team, and I can view all requests within the site vulnerable domains:connectnb.ups.com Steps To Reproduce: add details for how we can reproduce the issue ...

CVE-2022-24248

RiteCMS version 3.1.0 and below suffers from an arbitrary file deletion via path traversal vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to delete any file in the web root along with any other file on the server that the PHP process user has the prope...

CVE-2022-24247

RiteCMS version 3.1.0 and below suffers from an arbitrary file overwrite via path traversal vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to overwrite any file in the web root along with any other file on the server that the PHP process user has the...

Path traversal

RiteCMS version 3.1.0 and below suffers from an arbitrary file deletion via path traversal vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to delete any file in the web root along with any other file on the server that the PHP process user has the prope...

Path traversal

RiteCMS version 3.1.0 and below suffers from an arbitrary file overwrite via path traversal vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to overwrite any file in the web root along with any other file on the server that the PHP process user has the...

CVE-2022-24248

RiteCMS version 3.1.0 and below suffers from an arbitrary file deletion via path traversal vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to delete any file in the web root along with any other file on the server that the PHP process user has the prope...