306 matches found
PT-2023-26698
Name of the Vulnerable Software and Affected Versions django-sspanel version 2022.2.2 Description The software contains a remote command execution RCE issue through the GoodsCreateView. post component within sspanel/admin view.py. The software is used in proxy services, potentially leading to...
django-sspanel Command Injection Vulnerability
django-sspanel is a new shadowsocks web panel developed with diango by Ehco Personal Developers. A security vulnerability exists in django-sspanel version v2022.2.2, which stems from a Remote Command Execution RCE vulnerability in the GoodsCreateView.post method of sspanel/adminview.py...
CVE-2023-38941
django-sspanel v2022.2.2 was discovered to contain a remote command execution RCE vulnerability via the component sspanel/adminview.py - GoodsCreateView.post...
CVE-2023-3320
The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing nonce validation in the /admin/views/admin.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and injec...
CVE-2023-31843
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/viewfaculty.php?id=...
ChatBot < 4.4.9 - Subscriber+ OpenAI Settings Update to Stored XSS
The plugin does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escaping of the settings, this could also lead to Stored XSS Run the below command in...
PT-2023-17004 · Sourcecodester · Sourcecodester Student Study Center Desk Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Student Study Center Desk Management System version 1.0 Description: A critical issue affects the function view student of the file "admin/?page=students/view student". The manipulation of the argument id with a specific input...
CVE-2023-27210
Online Pizza Ordering System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/vieworder.php...
Online Pizza Ordering System SQL注入漏洞
Online Pizza Ordering System is an online pizza ordering system by Carlo Montero, an individual developer. A security vulnerability exists in Online Pizza Ordering System version 1.0, which is caused by a SQL injection vulnerability via the id parameter in /admin/vieworder.php...
CVE-2023-27210
Online Pizza Ordering System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/vieworder.php...
Cross site scripting
The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when an admin view the related contact message...
Hospital Management System SQL注入漏洞
The Hospital Management System HMS is a computerized system that helps manage healthcare-related information and helps healthcare providers do their jobs efficiently. A SQL injection vulnerability exists in Hospital Management System version 4.0, which stems from a SQL injection issue in the...
CVE-2022-42206: Improper Neutralization of Input During Web Page Generation
PHPGurukul Hospital Management System In PHP V 4.0 is vulnerable to Cross Site Scripting XSS via doctor/view-patient.php, admin/view-patient.php, and view-medhistory.php...
CVE-2022-33048
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/reservations/viewdetails.php...
CVE-2022-32025
Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/viewcar.php?id=...
CVE-2022-32012
Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/employee/index.php?view=edit&id=...
CVE-2022-31982
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/viewrequest&id=...
CVE-2022-31971
ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simplechatbot/admin/?page=responses/viewresponse&id=...