CVE-2020-25273

CVE-2020-25273 Online Bus Booking System 1.0, присутствует обход аутентификации на экране входа администратора в admin.php через SQL-инъекцию в имени пользователя или пароле. Поставщик - SourceCodester Продукт -...

CVE-2024-39248

Titre de l'exploit : SimpCMS v0.1 - Script intersite XSS CVE: CVE-2024-39248 Auteur de l'exploit : Jason Jacobs 0xjasonjacobs - Twitter Page d'accueil du fournisseur : https://sourceforge.net/projects/simpcms/ Point de terminaison vulnérable : /SimpCMS/admin.php Une vulnérabilité de script...

CVE-2025-57310

CVE-2025-57310 Une vulnérabilité de Cross-Site Request Forgery CSRF dans Salmen2/Simple-Faucet-Script v1.07 via une requête POST falsifiée vers admin.php?p=ads&c=1 permettant aux attaquants d'exécuter du code arbitraire. CWE CWE-352: Cross-Site Request Forgery CSRF Score de base CVSS v3.1: 8.8...

CVE-2022-27413

Hospital-Management-System v1.0 - SQLi Vendeur Description: La page vulnérable est admin.php http://you ip/HMS/admin.php Hospital-Management-System v1.0 Le paramètre adminname dans la page admin.php semble être vulnérable aux attaques par injection SQL. +sqlmap: python3 sqlmap.py -r Your post...

CVE-2026-38192

pluck-CMS-4.7.20-code-injection-vulnerability В admin.php функция moduleaddtosite перебирает весь массив $POST, разделяет управляемые пользователем имена параметров с помощью explode'|', ... и напрямую конкатенирует их в data/settings/themes//moduleconf.php. Этот файл впоследствии будет включён в...

CVE-2009-4623

CVE-2009-4623 Удаленная оболочка для CVE-2009-4623: Получите неинтерактивную оболочку, откройте другую оболочку для расширенного использования !!! usage: CVE-2009-4623.sh hostnameandPath example: CVE-2009-4623.sh http://192.168.1.24/advancedcommentsystem/admin.php options: -h этот хлам...

CVE-2026-90709: Improper Control of Generation of Code

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The...

CVE-2026-86670

A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the component Authentication Storage. Executing a manipulation of the argument Password can lead to password hash with insufficient computational effort. It is possib...

CVE-2026-86670 aircheng-org iWebShop-5 Authentication Storage admin.php weak password hash

A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the component Authentication Storage. Executing a manipulation of the argument Password can lead to password hash with insufficient computational effort. It is possib...

CVE-2026-86670 aircheng-org iWebShop-5 Authentication Storage admin.php weak password hash

A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the component Authentication Storage. Executing a manipulation of the argument Password can lead to password hash with insufficient computational effort. It is possib...

EUVD-2026-73927

A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the component Authentication Storage. Executing a manipulation of the argument Password can lead to password hash with insufficient computational effort. It is possib...

CVE-2026-86670

aircheng-org iWebShop-5 versions up to 5.15 contain a vulnerability in the Authentication Storage component within the file controllers/admin.php . Manipulating the Password argument can result in a password hash with insufficient computational effort , effectively weakening credential protection...

CVE-2026-86670 aircheng-org iWebShop-5 Authentication Storage admin.php weak password hash

A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the component Authentication Storage. Executing a manipulation of the argument Password can lead to password hash with insufficient computational effort. It is possib...

CVE-2026-86670: Use of Password Hash With Insufficient Computational Effort

A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the component Authentication Storage. Executing a manipulation of the argument Password can lead to password hash with insufficient computational effort. It is possib...

CVE-2026-63302

Quick.CMS is vulnerable to Local File Inclusion LFI in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure...

CVE-2026-63302: Improper Control of Filename for Include/Require Statement in PHP Program

Quick.CMS is vulnerable to Local File Inclusion LFI in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure...

CVE-2026-9577: Improper Neutralization of Input During Web Page Generation

The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page admin.php?page=post-status-notifier-lite, leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's sessi...

CVE-2026-58143: Cross-Site Request Forgery (CSRF)

Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes...

CVE-2026-57940: Server-Side Request Forgery (SSRF)

HTMLy 3.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the RSS feed import functionality. The function getfeed in system/admin/admin.php passes user-supplied $feedurl directly to filegetcontents without any validation. An authenticated attacker with administrative privileges can...

CVE-2026-45233: Improper Limitation of a Pathname to a Restricted Directory

HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by supplying directory traversal sequences in the oldfile parameter at the admin autosave endpoint. Attackers can pass unsanitized traversal sequences...