CVE-2021-24480: Improper Neutralization of Input During Web Page Generation

The Event Geek WordPress plugin through 2.5.2 does not sanitise or escape its "Use your own " setting before outputting it in the page, leading to an authenticated admin+ stored Cross-Site Scripting issue...

M-vSlider <= 2.1.3 - Authenticated (admin+) SQL Injection

The update functionality in the rsliderpage uses an rsid POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role. POST /wp-admin/admin.php?page=rsliderpage&updated=true HTTP/1.1 Host:...

CVE-2020-24984: Cross-Site Request Forgery (CSRF)

An issue was discovered in Quadbase EspressReports ES 7 Update 9. It allows CSRF, whereby an attacker may be able to trick an authenticated admin level user into uploading malicious files to the web server...

PT-2021-11094

Name of the Vulnerable Software and Affected Versions: Quadbase EspressReports ES version 7 Update 9 Description: An issue allows Cross-Site Request Forgery CSRF, whereby an attacker may trick an authenticated admin-level user into uploading malicious files to the web server. Recommendations: For...

CVE-2020-13409

Tufin SecureTrack R20-2 GA contains reflected + stored XSS as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users. Both stored, and reflected payloads are triggerable by admin, so...

CVE-2020-13409

Tufin SecureTrack R20-2 GA contains reflected + stored XSS as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users. Both stored, and reflected payloads are triggerable by admin, so...

PT-2021-9603

Name of the Vulnerable Software and Affected Versions Tufin SecureTrack versions prior to R20-2 GA Description The issue concerns reflected and stored XSS, where the value is not only reflected back to the user but also stored within the database. This stored payload can be triggered again by the...

Backdoor account found in 100,000+ Zyxel Firewalls, VPN Gateways

By Deeba Ahmed Researchers have discovered a hard-coded admin-level backdoor account as a Zyxel firmware binary revealing username and password. This is a post from HackRead.com Read the original post: Backdoor account found in 100,000+ Zyxel Firewalls, VPN Gateways...

CVE-2020-35708: Improper Neutralization of Special Elements used in an SQL Command

phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page...

CVE-2020-5426

CVE-2020-5426 affects the TAS Scheduler prior to version 1.4.0, which could transmit the UAA client token in plaintext over non-TLS connections. The risk is influenced by MySQL server configuration used to cache the token; interception could grant an attacker admin-level access in the cloud contr...

PT-2020-18477

Name of the Vulnerable Software and Affected Versions Scheduler for TAS versions prior to 1.4.0 Description The issue allows plaintext transmission of a UAA client token over a non-TLS connection, which depends on the configuration of the MySQL server used to cache the token. If the token is...

The vulnerability of the central control server of SiNVR 3 allows a hacker to read or modify the database of the central control server, as well as perform operations on the databases or operating system commands with administrator privileges.

The vulnerability of the central control server of SiNVR 3 Central Control Server lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to remotely read or modify the central control server’s database, as well as perform operations o...

Description of the cumulative update for Lync 2010 Attendee - Administrator level installation: June 2012

Describes the cumulative update for Lync 2010 Attendee, Administrator level installation that is dated June 2012.SummaryThis article describes the issue that is fixed in the cumulative update for Microsoft Lync 2010 Attendee - Administrator level installation that is dated June 2012.This article...

CVE-2020-10934: Unrestricted Upload of File with Dangerous Type

Acyba AcyMailing before 6.9.2 mishandles file uploads by admins...

Cross site scripting

Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would potentially impact other admins Tenable IDs 5218 and 5269...

Cross site scripting

Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would only potentially impact other admins. Tenable ID 5198...

CVE-2016-1000029

Tenable Nessus before version 6.8 is affected by a stored cross-site scripting (XSS) vulnerability. The issue stems from insufficient input filtering in Nessus UI, enabling an authenticated administrator to inject script code that could affect other admins. This CVE (CVE-2016-1000029) is document...

CVE-2016-1000028

Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would only potentially impact other admins. Tenable ID 5198...

PT-2019-7504

Name of the Vulnerable Software and Affected Versions Tenable Nessus versions prior to 6.8 Description The issue is a stored XSS that requires admin-level authentication to the Nessus UI and could potentially impact other admins. Recommendations For versions prior to 6.8, update to version 6.8 or...

PT-2019-7503

Name of the Vulnerable Software and Affected Versions Tenable Nessus versions prior to 6.8 Description The issue is a stored XSS that requires admin-level authentication to the Nessus UI. It would only potentially impact other admins. Recommendations For versions prior to 6.8, update to version 6...