7790 matches found
CVE-2024-50405
An improper neutralization of CRLF sequences 'CRLF Injection' vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to modify application data. We have already fixed the...
Ecommerce-Website 注入漏洞
Ecommerce-Website is a complete e-commerce website with an administration panel built using PHP and MySql. An injection vulnerability exists in Ecommerce-Website version 1.0, which stems from an incorrect operation of the parameter proid that can lead to SQL injection...
CVE-2025-1393
An unauthenticated remote attacker can use hard-coded credentials to gain full administration privileges on the affected product...
CVE-2025-1393 Weidmueller: Authentication Vulnerability due to Hard-coded Credentials
An unauthenticated remote attacker can use hard-coded credentials to gain full administration privileges on the affected product...
CVE-2025-1393
CVE-2025-1393: An unauthenticated remote attacker can use hard-coded credentials to gain full administration privileges on the affected product. Multiple connected sources confirm unauthenticated access with full admin rights; one listing ties the issue to Weidmueller PROCON-WIN versions prior to...
CVE-2025-1393 Weidmueller: Authentication Vulnerability due to Hard-coded Credentials
An unauthenticated remote attacker can use hard-coded credentials to gain full administration privileges on the affected product...
Linux Distros Unpatched Vulnerability : CVE-2013-7061
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an...
Calibre 7.15.0 Code Injection
Calibre version 7.15.0 remote code injection proof of concept exploit. ============================================================================================================================================= | Title : Calibre 7.15.0 PHP Code Injection Vulnerability | | Author : indoushka | |...
CVE-2025-22270
An attacker with access to the Administration panel, specifically the "Role Management" tab, can inject code by adding a new role in the "name" field. It should be noted, however, that the risk of exploiting vulnerability is reduced due to the required additional error that allows bypassing the...
The Trump Administration Is Deprioritizing Russia as a Cyber Threat
Plus: The FBI pins that ByBit theft on North Korea, a malicious app download breaches Disney, spyware targets a priest close to the pope, and more...
Formwork improperly validates input of User role preventing site and panel availability
Summary Improper validation of select fields allows attackers to craft an input that crashes the system, resulting in a 500 status and making the entire site and administration panel unavailable. This clearly impacts the Availability aspect of the CIA triad confidentiality, integrity, and...
CVE-2025-22270 Stored XSS in CyberArk Endpoint Privilege Manager
An attacker with access to the Administration panel, specifically the "Role Management" tab, can inject code by adding a new role in the "name" field. It should be noted, however, that the risk of exploiting vulnerability is reduced due to the required additional error that allows bypassing the...
CVE-2024-46226
A stored cross site scripting XSS vulnerability in HelpDeskZ v2.0.2 allows remote attackers to execute arbitrary JavaScript in the administration panel by including a malicious payload into the file name and upload file function when creating a new ticket...
CVE-2024-46226
A stored cross site scripting XSS vulnerability in HelpDeskZ v2.0.2 allows remote attackers to execute arbitrary JavaScript in the administration panel by including a malicious payload into the file name and upload file function when creating a new ticket...
CVE-2024-13494
The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. This is due to missing or incorrect nonce validation on the 'wfufiledetails' function. This makes it possible for unauthenticated attackers to modify user data...
Cross-site Scripting (XSS)
Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the site administration live log. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an...
CVE-2025-26529
Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk...
UBUNTU-CVE-2025-26529
Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk...
CVE-2025-26529
CVE-2025-26529 affects Moodle, with the root cause a vulnerability in how Description information is displayed in the site administration live log, requiring additional sanitizing to prevent stored XSS. The entry is evidenced across multiple feeds, including a GitHub PoC claiming a Moodle XSS to ...