CVE-2026-105382

The onetwothreeneth HospitalManagementSystem is vulnerable to improper authorization in the Account Administration component. Specifically, a flaw in the update_subaccount function within the php/controller.php file allows for the manipulation of the user_id argument. This vulnerability enables r...

CVE-2026-105382 onetwothreeneth HospitalManagementSystem Account Administration controller.php update_subaccount improper authorization

A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function updatesubaccount of the file php/controller.php of the component Account Administration. This manipulation of the argument userid causes improper...

CVE-2026-105382 onetwothreeneth HospitalManagementSystem Account Administration controller.php update_subaccount improper authorization

A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function updatesubaccount of the file php/controller.php of the component Account Administration. This manipulation of the argument userid causes improper...

CVE-2025-53072-CVE-2025-62481

CVE-2025-53072 & CVE-2025-62481 Vulnerability in the Oracle Marketing product of Oracle E-Business Suite component: Marketing Administration. How does this detection method work? This Nuclei template detects Oracle E-Business Suite instances vulnerable to CVE-2025-53072 and CVE-2025-62481 by...

CVE-2026-104706

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://:8443 via menus Administration - View Logs...

CVE-2026-104706 Mitel MiVoice Office 400 view system files path traversal

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://:8443 via menus Administration - View Logs...

EUVD-2026-92289

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://:8443 via menus Administration - View Logs...

CVE-2026-104706

The Mitel MiVoice Office 400 system is affected by a path traversal vulnerability (CWE-31). This flaw allows an attacker with high privileges to view or download sensitive system files via the portal at https://:8443 specifically through the Administration -> View Logs menu. The vulnerability ...

CVE-2023-43879-RiteCMS-Stored-XSS---GlobalContent

Rite CMS v3.0 Multiple Stored XSS Author: Sergio Description: Rite CMS 3.0 is affected by a Cross-Site scripting XSS stored vulnerability that allows attackers to execute arbitrary code via a crafted payload in to the Global Content Blocks in the Administration Menu. Attack Vectors:...

Apache ActiveMQ <=5.15.5 - Cross-Site Scripting

Apache ActiveMQ versions 5.0.0 to 5.15.5 are vulnerable to cross-site scripting via the web based administration console on the queue.jsp page. The root cause of this issue is improper data filtering of the QueueFilter parameter. id: CVE-2018-8006 info: name: Apache ActiveMQ =5.15.5 - Cross-Site...

DotNetNuke 07.04.00 - Administration Authentication Bypass

The installation wizard in DotNetNuke DNN before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx. id: CVE-2015-2794 info: name: DotNetNuke 07.04.00 - Administration Authentication Bypass author: 0xr2r severity...

i-Panel Administration System 2.0 - Cross-Site Scripting

i-Panel Administration System 2.0 contains a cross-site scripting vulnerability that enables an attacker to execute arbitrary JavaScript code in the browser-based web console. id: CVE-2021-41878 info: name: i-Panel Administration System 2.0 - Cross-Site Scripting author: madrobot severity: medium...

Adobe Coldfusion - Authentication Bypass

Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints...

DNN_CVE-2015-2794

DNNCVE-2015-2794 NSE plugin for Nmap that scans a DotNetNuke DNN web application for an Administration Authentication Bypass vulnerability CVE-2015-2794, EDB-ID: 39777...

CVE-2025-25612

CVE-2025-25612: Switch FS S3150-8T2F Vulnerabilidad de Cross Site Scripting XSS Almacenado CVE-2025-25612 FS Inc S3150-8T2F anterior a la versión S3150-8T2F2.2.0D135103 es vulnerable a Cross Site Scripting XSS en la funcionalidad de Configuración de Rango de Tiempo de la interfaz de administració...

EUVD-2026-91832

Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints...

CVE-2026-105046

Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints...

CVE-2026-105046

Kentico Xperience 13 versions prior to 13.0.216 are vulnerable to an object-level authorization deficiency. The issue stems from a lack of proper authorization checks for administration API endpoints , which may allow unauthorized access to administrative functions. Specific details regarding the...

CVE-2026-105046

Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints...

CVE-2026-75937

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device...