5001 matches found
Unrestricted File Upload
showdoc/showdoc allows unrestricted file uploads. An attacker is able to login to the admin panel and obtains server privileges via the unrestricted file upload vulnerability in AdminUpdateController.class.php...
Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting
Vulnerability Type Stored Cross Site-Scripting XSS Affected URL https://localhost/openemr-6.0.0/ /interface/super/rules/index.php?action=edit!submitsummary Affected Parameters “fldtitle” Authentication Required? Yes Issue Summary Non-privilege users accounting, front-office can create new rule an...
iRZ Mobile Routers 跨站请求伪造漏洞
iRZ Mobile Routers is a series of mobile routers from the Russian company iRZ. A security vulnerability exists in /api/crontab of iRZ Mobile Routers, which can be exploited by an attacker to create a crontab entry in the router's administration panel, which will be executed by a cronjob at an...
Cross site scripting
Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting XSS code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the...
CVE-2022-24749 Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius
Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting XSS code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the...
CVE-2022-24749
Sylius SVG XSS risk (CVE-2022-24749): Prior to versions 1.9.10, 1.10.11, and 1.11.2, uploading an SVG in the admin panel could execute XSS if the file was opened outside of an IMG tag or in a new card. The issue affects files displayed on admin and shop pages and is fixed in 1.9.10, 1.10.11, and ...
CVE-2022-24749 Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius
Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting XSS code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the...
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting XSS code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the...
Sylius 跨站脚本漏洞
Sylius is an open source e-commerce platform. Sylius suffers from a cross-site scripting vulnerability that could be exploited by attackers to upload SVG files containing XSS code in the administration panel to obtain user cookies and construct phishing attacks...
WordPress plugin 跨站脚本漏洞
WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. WordPress plugin is a WordPress application plugin. WordPress Cookie Information | Free GDPR Consent Solution plugin prior to version 2.0.8 is vulnerable to A cross-site scripting vulnerability...
Sql injection
Luocms v2.0 is affected by SQL Injection in /admin/news/sortmod.php...
PT-2022-2581 · Mybb · Mybb
Name of the Vulnerable Software and Affected Versions: MyBB versions prior to 1.8.30 Description: The issue is related to the Admin CP's Settings management module, which does not validate setting types correctly on insertion and update. This allows an attacker to add settings of supported type p...
Easy Social Icons < 3.1.4 - Admin+ SQL Injection
The plugin does not sanitize the selectedicons attribute to the cnsswidget before using it in an SQL statement, leading to a SQL injection vulnerability. PoC Author : Qerogram import requests from bs4 import BeautifulSoup BASEURL = "http://localhost:8000" id = "wordpress" pw = "wordpress" def...
Plezi < 1.0.3 - Unauthenticated Stored XSS
The plugin has a REST endpoint allowing unauthenticated users to update the plzconfigurationtrackerenable option, which is then displayed in the admin panel without sanitisation and escaping, leading to a Stored Cross-Site Scripting issue PoC curl -X POST...
CVE-2022-25045
Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel...
CVE-2022-25045
Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel...
CVE-2022-25045
CVE-2022-25045 concerns Home Owners Collection Management System v1.0, where hardcoded credentials are reported to allow attackers to escalate privileges and access the admin panel. The linked sources across CVE registries (NVD, RH/Red Hat, CNVD, CNVD equivalents, CVE lists) corroborate that the ...
Hospital Management System Cross-Site Scripting Vulnerability (CNVD-2022-67482)
Hospital Management System is a hospital management system. The system includes patient information management, ward management, surgery schedule management and financial management, etc. A cross-site scripting vulnerability exists in Hospital Management System v1.0, which stems from the lack of...
