2947 matches found
CVE-2020-25514: Improper Neutralization of Special Elements used in an SQL Command
Sourcecodester Simple Library Management System 1.0 is affected by Incorrect Access Control via the Login Panel, http:// /lms/admin.php...
Cross site scripting
Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting XSS via the 'Recall Settings' field in admin.php. An attacker can inject JavaScript code that will be stored and executed...
CVE-2020-25380: Improper Neutralization of Input During Web Page Generation
Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting XSS via the 'Recall Settings' field in admin.php. An attacker can inject JavaScript code that will be stored and executed...
PT-2020-15573
Name of the Vulnerable Software and Affected Versions PHP-Fusion version 9.03.60 Description The issue concerns Cross Site Scripting XSS that can be executed via the infusions/member poll panel/poll admin.php file. Recommendations For PHP-Fusion version 9.03.60, update to a newer version that...
CVE-2020-10984
Gambio GX before 4.0.1.0 allows admin/admin.php CSRF...
CVE-2020-10984
Gambio GX before 4.0.1.0 allows admin/admin.php CSRF...
CVE-2020-10984
Gambio GX (before 4.0.1.0) contains a CSRF vulnerability in admin/admin.php. The CVE entry CVE-2020-10984 documents a cross-site request forgery flaw affecting the admin interface; no explicit remediation is provided in the connected sources. The public references confirm the affected product/ver...
PT-2020-12470
Name of the Vulnerable Software and Affected Versions Gambio GX versions prior to 4.0.1.0 Description The issue allows for XSS in the admin/coupon admin.php file. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world...
PT-2020-12469
Name of the Vulnerable Software and Affected Versions Gambio GX versions prior to 4.0.1.0 Description The issue allows for a CSRF attack on the admin/admin.php endpoint. This can be exploited by tricking an administrator into performing unintended actions on the Gambio GX platform. Recommendation...
CVE-2020-10984: Cross-Site Request Forgery (CSRF)
Gambio GX before 4.0.1.0 allows admin/admin.php CSRF...
CVE-2019-19110
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter...
PT-2020-10053
Name of the Vulnerable Software and Affected Versions wpForo plugin version 1.6.5 Description The issue allows for XSS via the "wp-admin/admin.php?page=wpforo-phrases" API endpoint, specifically through the langid parameter. Recommendations For wpForo plugin version 1.6.5, avoid using the langid...
PT-2020-10051
Name of the Vulnerable Software and Affected Versions wpForo plugin version 1.6.5 Description The issue concerns a CSRF vulnerability in the wpForo plugin for WordPress. It affects the "wp-admin/admin.php?page=wpforo-usergroups" endpoint. There is no information provided about the estimated numbe...
CVE-2019-19111: Improper Neutralization of Input During Web Page Generation
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter...
CVE-2019-19110: Improper Neutralization of Input During Web Page Generation
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter...
CVE-2019-19109: Cross-Site Request Forgery (CSRF)
The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF...
PT-2020-10052
Name of the Vulnerable Software and Affected Versions wpForo plugin version 1.6.5 Description The issue allows for XSS via the "s" parameter in the "/admin.php?page=wpforo-phrases" API endpoint. Recommendations For wpForo plugin version 1.6.5, avoid using the s parameter in the...
PT-2020-2913
Name of the Vulnerable Software and Affected Versions D-Link DIR-865L Ax version 1.20B01 Beta Description The issue is related to the cleartext storage of sensitive information in the D-Link DIR-865L Ax router's firmware. This is due to a lack of protection for service data in the tools admin.php...