Every user's rUSDY balance can be changed suddenly by updating RWADynamicOracle.ranges before block.timestamp

Lines of code Vulnerability details Impact RWADynamicOracle.overrideRange and setRange can change the USDY price in rUSDY and the rUSDY balance in a tx. 1. Users cannot believe the rUSDY balance because ranges can be updated by an admin at any time. 2. When USDY price in rUSDY changes in a tx, a...

Lock User Account < 1.0.4- Arbitrary Account Lock/Unlock via CSRF

Description The plugin does not have CSRF check when bulk locking and unlocking accounts, which could allow attackers to make logged in admins lock and unlock arbitrary users via a CSRF attack Make a logged in admin open one of the links below, this will make them lock/unlock the user with ID 5...

CVE-2023-39805

iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php...

Datalife Engine 10 SQL Injection

==================================================================================================================================== | Title : Datalife Engine v10 ir SQl injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 64.0.2...

CVE-2023-37917

KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the isadmin value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version 1.6.5. Users are...

Server side request forgery (ssrf)

KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the isadmin value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version 1.6.5. Users are...

WordPress Plugin SP Project & Document Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

Old Age Home Management 1.0 SQL Injection

Title: Old Age Home Management-2022-2023-1.0 SQLi-Bypass-Authentication-Account-Take-Over Author: nu11secur1ty Date: 04.29.2023 Vendor: BY ANUJ KUMAR, https://phpgurukul.com/author/anujk305/ Software: https://phpgurukul.com/old-age-home-management-system-using-php-and-mysql/googlevignette...

CVE-2023-30613 Kiwi TCMS unrestricted file upload vulnerability

Kiwi TCMS, an open source test management system, allows users to upload attachments to test plans, test cases, etc. In versions of Kiwi TCMS prior to 12.2, there is no control over what kinds of files can be uploaded. Thus, a malicious actor may upload an .exe file or a file containing embedded...

PT-2023-11567 · Publiccms · Publiccms

Name of the Vulnerable Software and Affected Versions: PublicCMS version 4.0 Description: A SQL Injection issue allows a remote attacker to execute arbitrary code via the sql parameter of the SysSiteAdminControl. Recommendations: For PublicCMS version 4.0, update to a version that includes a fix...

Ability to control the filename when uploading a logo or favicon as admin in the theming settings

None...

Admin should be able to refund or redeem the sanctioned users

Lines of code Vulnerability details Impact Sanctioned user's funds are locked Proof of Concept It is understood that the sanctioned users can not mint nor redeem because the functions requestMint and requestRedemption are protected by the modifier checkKYC. And it is also understood that the...

PT-2023-14787 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB versions prior to 1.8.33 Description: The issue allows remote authenticated users with high privileges to achieve local file inclusion and execution through the Admin CP Languages module, due to a Directory Traversal vulnerability...

After the redrawing the winner can lose his NFT for the Admin

Lines of code Vulnerability details Impact The owner can manipulate the raffle by deprivation of a specific address winner Proof of Concept Please copy the following POC on VRFNFTRandomDraw.t.sol function testadminRedrawingandReclaimnft public address winner = address0x1337; address winner2 =...

Delayed contests might be rugpulled by admin

Lines of code Vulnerability details In order to guarantee the raffle NFT will not be stuck in the contract, there’s a last resort option which allows the admin the reclaim the NFT from the contract. However, the timestamp as from which this action can take place, is calculated based on when the...

CVE-2022-43709

MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input or stored search filter settings...

MyBB SQL注入漏洞

MyBB MyBulletinBoard is a free and web-based forum software developed by MYBB team using PHP and MySQL. The software is easy to use, supports multiple languages, scalable and so on. A SQL injection vulnerability exists in MyBB version 1.8.31, which originates from a cross-site scripting...

CVE-2022-43709

MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input or stored search filter settings...

Admin can set very low or very high value for setting fees & collateral factor in Market.sol resulting in value loss and/or DoS

Lines of code Vulnerability details Proof of Concept The contract’s admin has control to set values in setCollateralFactorBps, setLiquidationFactorBps, setReplenismentIncentiveBps, setLiquidationIncentiveBps, setLiquidationFeeBps. All of them have upper bounds, most of them have lower bounds, but...

[M1] Owner can steal any createdPledge's tokens

Lines of code Vulnerability details Impact Malicious owner can steal any created pledge even to drain the whole contract Proof of Concept Functions like recoverERC20 are good to recover tokens accidentally transferred to a contract. The common approach for these function is to exclude real tokens...