Shortlinks by Pretty Links < 3.6.3 - Reflected Cross-Site Scripting via post_status

Description The plugin does not sanitise and escape the poststatus parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

JetBrains TeamCity 安全漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A security vulnerability exists in JetBrains...

CVE-2024-29303

The delete admin users function of SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection...

CVE-2024-29303

The delete admin users function of SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection...

CVE-2023-50895

CVE-2023-50895 affects Janitza GridVis up to version 9.0.66; exposed dangerous methods in the de.janitza.pasw.project.server.ServerDatabaseProject load functionality allow remote authenticated administrative users to execute arbitrary Groovy code. Exploitation context and technical details are su...

CVE-2024-29303

The delete admin users function of SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection...

CVE-2024-29303

CVE-2024-29303 affects SourceCodester PHP Task Management System 1.0. The delete admin users function is vulnerable to SQL Injection, with an attacker-controlled admin_id parameter (GET). Public references show a crafted exploit attempting SQL manipulation, indicating potential data disclosure/mo...

CVE-2024-29303

The delete admin users function of SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection...

Everest Backup < 2.2.5 - Admin+ Arbitrary File Upload

Description The plugin does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup PoC 1. Go to the plugin setting and in the "Restore" section...

PT-2024-22854 · Sourcecodester · Sourcecodester Php Task Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester PHP Task Management System version 1.0 Description: The delete admin users function is vulnerable to SQL Injection. This issue allows for potential exploitation, but no specific details about the estimated number of affected...

Anchor 安全漏洞

Anchor is an open source lightweight blogging system. A security vulnerability exists in Anchor CMS version v0.12.7, which stems from a cross-site request forgery CSRF in /anchor/admin/users/delete/2...

CVE-2024-2754

A vulnerability classified as critical has been found in SourceCodester Complete E-Commerce Site 1.0. Affected is an unknown function of the file /admin/usersphoto.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit h...

PT-2024-21941 · Sourcecodester · Sourcecodester Complete E-Commerce Site

Name of the Vulnerable Software and Affected Versions: SourceCodester Complete E-Commerce Site version 1.0 Description: A critical vulnerability has been found in the SourceCodester Complete E-Commerce Site, affecting an unknown function of the file /admin/users photo.php. The manipulation of the...

SourceCodester E-Commerce Site 代码问题漏洞

E-Commerce Site is an e-commerce website. A code issue vulnerability exists in SourceCodester Complete E-Commerce Site version 1.0, which stems from a file upload vulnerability in file /admin/usersphoto.php...

CVE-2024-2535

A vulnerability has been found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/users.php. The manipulation of the argument id leads to cross site scripting. The attack can be initiated remotel...

Online-College-Event-Hall-Reservation-System Cross-Site Scripting Vulnerability

Online-College-Event-Hall-Reservation-System is an online college event hall reservation system by Magesh K individual developer. Designed to automate the hall booking process to eliminate manual logging and increase efficiency. A cross-site scripting vulnerability exists in...

Online-College-Event-Hall-Reservation-System SQL Injection Vulnerability

Online-College-Event-Hall-Reservation-System is an online college event hall reservation system by Magesh K individual developer. Designed to automate the hall booking process to eliminate manual logging and increase efficiency. Online-College-Event-Hall-Reservation-System suffers from a SQL...

CVE-2024-28254 SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The ‎AlertUtil::validateExpression method evaluates an SpEL expression using getValue which by default uses the...

CVE-2024-28194 Authentication Bypass Because of Hardcoded JWT Secret in your_spotify

yourspotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions 1.8.0 use a hardcoded JSON Web Token JWT secret to sign authentication tokens. Attackers can use this well-known value to forge valid authentication tokens for arbitrary users. This vulnerability allows...

WooCommerce Product Filter < 1.4.4 - Reflected XSS

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open the URL below the filter with the slug test1 needs to...