CVE-2022-41406

CVE-2022-41406 concerns an arbitrary file upload vulnerability in Church Management System v1.0, specifically the /admin/admin_pic.php component, allowing an attacker to execute arbitrary code via a crafted PHP file. The CVSS data in the entry indicates high impact (Confidentiality, Integrity, Av...

PT-2022-24855 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB versions prior to 1.8.31 Description: The issue in MyBB allows access to sensitive information and Remote Code Execution RCE through the mail parameters setting value in the Mail Settings → Additional Parameters for PHP's mail function, ...

CVE-2022-37461

Multiple cross-site scripting XSS vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary web script or HTML via 1 the input after the error subdirectory to the /vitrea-view/error/ subdirectory, or the 2 groupID, 3 offset, or 4 limit parameter to a...

CVE-2022-40403

Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/featureedit.php...

Online Tours & Travels Management System SQL注入漏洞

Online Tours ＆ Travels Management System is an online travel management system by Mayuri K Personal Developer. A SQL injection vulnerability exists in Online Tours & Travels Management System version v1.0 due to a lack of validation of externally-entered SQL statements in the id parameter of its...

Online Tours & Travels Management System SQL注入漏洞

Online Tours & Travels Management System is an online travel management system by Mayuri K. Personal developer. A SQL injection vulnerability exists in Online Tours & Travels Management System version v1.0 due to a lack of validation of externally-entered SQL statements in the id parameter of its...

Cross-Site Scripting: The Real WordPress Supervillain

Vulnerabilities are a fact of life for anyone managing a website, even when using a well-established content management system like WordPress. Not all vulnerabilities are equal, with some allowing access to sensitive data that would normally be hidden from public view, while others could allow a...

Multiple Authenticated Remote Code Execution Vulnerabilities in Admin Panel

Description An attacker with administrative privileges in the openEMR application can execute arbitrary code on the server remote code execution RCE. This was tested in openEMR version 7.0.0 1 but also affects previous versions of openEMR. Proof of Concept First of all, start a netcat listener on...

Cross site scripting

Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting XSS in /admin/myaccount...

CVE-2021-44076

An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with access to the administration panel, to perform Stored Cross-Site Scripting XSS. The payload can be executed in multiple scenarios, for example when the user'...

Academy Learning Management System 5.7 Shell Upload

Exploit Title: Academy Learning Management System 5.7 Shell Upload Exploit Author: th3d1gger Vendor Homepage: https://codecanyon.net Software Link: https://codecanyon.net/item/academy-course-based-learning-management-system/22703468 Version: 5.7 Tested on Ubuntu 18.04 Totally wrong architecture f...

Church Management System SQL注入漏洞

Church Management System is a church management system. A security vulnerability exists in Church Management System v1.0, which originates from a SQL injection vulnerability in the id parameter via /admin/editevent.php...

CVE-2022-38276

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list...

CVE-2022-38281

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list...

CVE-2022-38247

Nagios XI v5.8.6 was discovered to contain a cross-site scripting XSS vulnerability via the System Settings page under the Admin panel...

CVE-2022-38247

Nagios XI v5.8.6 was discovered to contain a cross-site scripting XSS vulnerability via the System Settings page under the Admin panel...

CVE-2022-38247

Nagios XI v5.8.6 was discovered to contain a cross-site scripting XSS vulnerability via the System Settings page under the Admin panel...

CVE-2022-38251

Nagios XI v5.8.6 was discovered to contain a cross-site scripting XSS vulnerability via the System Performance Settings page under the Admin panel...

CVE-2022-38251

Nagios XI v5.8.6 was discovered to contain a cross-site scripting XSS vulnerability via the System Performance Settings page under the Admin panel...

CVE-2022-38251

Nagios XI v5.8.6 was discovered to contain a cross-site scripting XSS vulnerability via the System Performance Settings page under the Admin panel...