86 matches found
CVE-2024-24160
MRCMS 3.0 contains a Cross-Site Scripting XSS vulnerability via /admin/system/saveinfo.do...
CVE-2024-24160
MRCMS 3.0 contains a Cross-Site Scripting XSS vulnerability via /admin/system/saveinfo.do...
CVE-2024-24160: Improper Neutralization of Input During Web Page Generation
MRCMS 3.0 contains a Cross-Site Scripting XSS vulnerability via /admin/system/saveinfo.do...
MRCMS Security Vulnerabilities
MRCMS is a content management system by marker personal developer. A security vulnerability exists in MRCMS version 3.0, which was discovered to contain a cross-site scripting XSS vulnerability via /admin/system/saveinfo.do...
CVE-2021-31280
An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the keywords parameter...
Design/Logic Flaw
An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the keywords parameter...
Online Computer and Laptop Store 代码问题漏洞
Online Computer and Laptop Store is an online computer and laptop store from Carlo Montero's personal developer. Online Computer and Laptop Store v1.0 is vulnerable to arbitrary file uploads. The vulnerability stems from a lack of validation of uploaded files in the...
Meizhou Qingyunke QYKCMS 代码问题漏洞
Meizhou Qingyunke QYKCMS Qingyunke Website Management System is a website management system of Meizhou Qingyunke Network Technology Meizhou Qingyunke Company in China. Meizhou Qingyunke QYKCMS version 4.3.0 has a code issue vulnerability, the vulnerability stems from the function downurl found in...
Sql injection
A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It has been classified as critical. This affects an unknown part of the file /api/admin/system/store/order/list. The manipulation of the argument keywords leads to sql injection. The exploit has been disclosed to the public and may be used...
CVE-2023-1165 Zhong Bang CRMEB Java list sql injection
A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It has been classified as critical. This affects an unknown part of the file /api/admin/system/store/order/list. The manipulation of the argument keywords leads to sql injection. The exploit has been disclosed to the public and may be used...
CVE-2023-1165: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It has been classified as critical. This affects an unknown part of the file /api/admin/system/store/order/list. The manipulation of the argument keywords leads to sql injection. The exploit has been disclosed to the public and may be used...
CVE-2022-37786: Improper Neutralization of Formula Elements in a CSV File
An issue was discovered in WeCube Platform 3.2.2. There are multiple CSV injection issues: the Home / Admin / Resources page, the Home / Admin / System Params page, and the Home / Design / Basekey Configuration page...
CVE-2022-37786
An issue was discovered in WeCube Platform 3.2.2. There are multiple CSV injection issues: the Home / Admin / Resources page, the Home / Admin / System Params page, and the Home / Design / Basekey Configuration page...
CVE-2021-41878
A reflected cross-site scripting XSS vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console and it is possible to insert a vulnerable malicious button...
CVE-2021-41878
CVE-2021-41878 affects i-Panel Administration System 2.0. A reflected cross-site scripting (XSS) flaw allows remote attackers to execute arbitrary JavaScript in the browser-based web console. PoCs show crafted URLs (e.g., /lostpassword.php/…) injecting script; multiple public writeups and exploit...
CVE-2021-38699
TastyIgniter 3.0.7 allows XSS via /account, /reservation, /admin/dashboard, and /admin/systemlogs...
CVE-2020-5788: Improper Limitation of a Pathname to a Restricted Directory
Relative Path Traversal in Teltonika firmware TRB2R00.02.04.3 allows a remote, authenticated attacker to delete arbitrary files on disk via the admin/system/admin/certificates/delete action...
Kartpay: Admin/Info lekage
The Administrator System was opened in public which can be misused by anyone so to avoid a Security system has been implemented to allow from limited Ip address only...
Design/Logic Flaw
XSS in the admin help system admin/help.html and admin/quicklinks.html in Interchange 4.7.0 through 5.11.x allows remote attackers to steal credentials or data via browser JavaScript...