CVE-2019-7869

Magento 2.x stores a stored XSS in the admin panel, exploitable by an authenticated user with permission to manage customer groups. Affected versions: 2.1.x before 2.1.18, 2.2.x before 2.2.9, 2.3.x before 2.3.2. Remediation: apply the security updates released for these branches (e.g., Magento 2....

CVE-2019-7868

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with permissions to manage tax rules...

CVE-2019-7868

Magento 2: A stored cross-site scripting (XSS) vulnerability exists in the admin panel for Magento 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. It can be exploited by an authenticated user who has permissions to manage tax rules. Impact details in the connected Red Hat advisory conf...

CVE-2019-7867

CVE-2019-7867 : A stored cross-site scripting vulnerability exists in the Magento Admin Panel. Affected: Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, and Magento 2.3 prior to 2.3.2. Exploitation requires an authenticated user with access to manage orders and order status. Root cause: ...

CVE-2019-7866

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor...

CVE-2019-7866

Magento 2.x suffers a stored XSS in the admin panel, affecting 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. An authenticated user with access to edit product information via the TinyMCE editor can exploit it. Root cause: lack of input sanitization in admin product editing flow. Impa...

CVE-2019-7863

A stored cross-site scripting vulnerability exists in the Magento admin panel affecting Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, and Magento 2.3 prior to 2.3.2. The issue can be exploited by an authenticated user with access to products and categories, due to the underlying XSS in...

CVE-2019-7863

A stored cross-site scripting vulnerability exists in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to products and categories...

CVE-2019-7862

Magento 2.x Reflected XSS in Product widget chooser (admin) affects: 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. Root cause: reflected cross-site scripting in the admin panel’s Product widget chooser. Impact: as described, enabling an attacker to inject scripts via user input durin...

CVE-2019-7862

A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...

CVE-2019-7852

A path disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Requests for a specific file path could result in a redirect to the URL of the Magento admin panel, disclosing its location to potentially unauthorized parties...

CVE-2013-7474

Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter to admin/users...

Shopify: Inject page in admin panel via Shopify.API.pushState

Summary Shopify.API.pushState call the method handleRoutePushEvent, allows you to change routes to open pages from admin panel: js handleRoutePushEventpathname: e, search: t, state: a, hash: o const adminPath: n, history: i = this.props // adminPath = /admin , s = "".concatn.concate; // // If we...

Cross site request forgery (csrf)

Xavier PHP Management Panel 3.0 is vulnerable to Reflected POST-based XSS via the username parameter when registering a new user at admin/includes/adminprocess.php. If there is an error when registering the user, the unsanitized username will reflect via the error page. Due to the lack of CSRF...

OECMS Cross-Site Request Forgery Vulnerability

OECMS is an enterprise web content management system CMS. A cross-site request forgery vulnerability exists in the admincp.php file in OECMS. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker could use this...

Uber: Unsecured Dropwizard Admin Panel on display.uber-adsystem.com exposes sensitive server information

The dropwizard instance running on display.uber-adsystem.com is unsecured, meaning any unauthenticated user can view and use it's admin tools. These tools expose sensitive information on Uber production servers, including the current threads running, info on the CPU, and more server info that...

Sql injection

Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=uiset&m=admin&c=index&a=dogettextcontent&table=lang&field=1 request...

Magento Administration Panel Login Form Detected

Magento Administration Panel has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative functionality. No...

U.S. Dept Of Defense: [██████████] Unauthorized access to admin panel

In previous reports, I described vulnerabilities in a panel to which I had access. 512269 512693 512695 I could log in to this site and then perform some attacks, such as SQL injection\XSS or other bugs. But before the above vulnerabilities were considered by you, the possibility to bypass...

CVE-2019-13029

Multiple stored Cross-site scripting XSS issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to inject arbitrary malicious HTML or JavaScript code into a user's web browser...