Stored XSS via blog author parameter on admin.php?p=config

Description The blog author parameter is unsanitized on the page admin.php?p=config. In this way is possible to inject arbitrary javascript code Proof of Concept - Login as regular user - Go to http://localhost/flatpress/admin.php?p=config - Set as blog author "alertdocument.domain - Refresh page...

Cross site scripting

A vulnerability was found in annyshow DuxCMS 2.1. It has been classified as problematic. This affects an unknown part of the file admin.php&r=article/AdminContent/edit of the component Article Handler. The manipulation of the argument content leads to cross site scripting. It is possible to...

PT-2022-9011 · Unknown · Annyshow Duxcms

Name of the Vulnerable Software and Affected Versions: annyshow DuxCMS version 2.1 Description: A vulnerability was found in the file admin.php&r=article/AdminContent/edit of the component Article Handler. The manipulation of the content argument leads to cross-site scripting. It is possible to...

CVE-2020-36609: Improper Neutralization

A vulnerability was found in annyshow DuxCMS 2.1. It has been classified as problematic. This affects an unknown part of the file admin.php&r=article/AdminContent/edit of the component Article Handler. The manipulation of the argument content leads to cross site scripting. It is possible to...

Cross site scripting

Web-Based Student Clearance System v1.0 was discovered to contain a cross-site scripting XSS vulnerability in Admin/add-admin.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtfullname parameter...

PT-2022-27444 · Unknown · Web-Based Student Clearance System

Name of the Vulnerable Software and Affected Versions: Web-Based Student Clearance System version 1.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtfullname parameter in the Admin/add-admin.php file. This enables the...

CVE-2022-45224: Improper Neutralization of Input During Web Page Generation

Web-Based Student Clearance System v1.0 was discovered to contain a cross-site scripting XSS vulnerability in Admin/add-admin.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtfullname parameter...

CVE-2022-45224

CVE-2022-45224 is an XSS vulnerability affecting the Web-Based Student Clearance System v1.0, with the flaw in Admin/add-admin.php where a crafted payload in the txtfullname parameter can execute arbitrary scripts/HTML. The connected sources confirm the issue but do not provide exploit details or...

CVE-2022-3973 Pingkon HMS-PHP Data Pump Metadata admin.php sql injection

A vulnerability classified as critical has been found in Pingkon HMS-PHP. Affected is an unknown function of the file /admin/admin.php of the component Data Pump Metadata. The manipulation of the argument uname/pass leads to sql injection. It is possible to launch the attack remotely. The exploit...

CVE-2022-3973

CVE-2022-3973 affects Pingkon HMS-PHP, specifically the Data Pump Metadata component, in the file /admin/admin.php. The issue is a SQL injection caused by manipulation of the uname/pass parameter, allowing remote exploitation. Multiple sources (NVD, CVE lists, Red Hat, PRION, etc.) confirm a crit...

CVE-2022-3973: Improper Neutralization

A vulnerability classified as critical has been found in Pingkon HMS-PHP. Affected is an unknown function of the file /admin/admin.php of the component Data Pump Metadata. The manipulation of the argument uname/pass leads to sql injection. It is possible to launch the attack remotely. The exploit...

CVE-2022-43076

The vulnerability CVE-2022-43076 affects Web-Based Student Clearance System v1.0. A cross-site scripting (XSS) flaw exists in the /admin/edit-admin.php endpoint, exploitable by injecting crafted payloads into the txtemail parameter to execute arbitrary web scripts/HTML. The provided references co...

CVE-2022-3733

A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. This affects an unknown part of the file Admin/edit-admin.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploi...

CVE-2022-3733: Improper Neutralization

A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. This affects an unknown part of the file Admin/edit-admin.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploi...

CVE-2022-3733

SourceCodester Web-Based Student Clearance System is affected. The vulnerability is in Admin/edit-admin.php where manipulating the id parameter triggers a SQL injection. It can be exploited remotely and publicly disclosed; no remediation details are provided in the supplied documents.

CVE-2022-40047: Improper Neutralization of Input During Web Page Generation

Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting XSS vulnerability via the page parameter at /flatpress/admin.php...

FlatPress 跨站脚本漏洞

FlatPress is a Php-based blog builder without database support from the FlatPress community. A cross-site scripting vulnerability exists in FlatPress v1.2.1, which was discovered to contain a cross-site scripting XSS vulnerability via the page parameter on /Flatpress/admin.php...

CVE-2022-36572

Sinsiu Sinsiu Enterprise Website System v1.1.1.0 was discovered to contain a remote code execution RCE vulnerability via the component /upload/admin.php?/deal/...

Remote code execution

Sinsiu Sinsiu Enterprise Website System v1.1.1.0 was discovered to contain a remote code execution RCE vulnerability via the component /upload/admin.php?/deal/...

CVE-2022-36572: Undefined Security Weakness

Sinsiu Sinsiu Enterprise Website System v1.1.1.0 was discovered to contain a remote code execution RCE vulnerability via the component /upload/admin.php?/deal/...