CVE-2022-28810

Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with...

Code injection

DISPUTED SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the themes can be modified by an administrator. NOTE: the vendor's position is that administrators are intended to have the ability to...

CVE-2022-26982

SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the themes can be modified by an administrator. NOTE: the vendor's position is that administrators are intended to have the ability to modify theme...

CVE-2022-26982: Improper Control of Generation of Code

SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the themes can be modified by an administrator. NOTE: the vendor's position is that administrators are intended to have the ability to modify theme...

Nozomi Networks Guardian 输入验证错误漏洞

Nozomi Networks Guardian is an IoT device and software inspection system from Nozomi Networks, Switzerland. An input validation error vulnerability exists in versions of Nozomi Networks Guardian prior to 22.0.0, which can be exploited by an authenticated attacker with the administrator or import...

CVE-2022-26521

Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the CatalogMedia ManagerImages settings can be changed by an administrator e.g., by configuring .php to be a valid image file type...

Design/Logic Flaw

Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the CatalogMedia ManagerImages settings can be changed by an administrator e.g., by configuring .php to be a valid image file type...

CVE-2022-26521

Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the CatalogMedia ManagerImages settings can be changed by an administrator e.g., by configuring .php to be a valid image file type...

CVE-2022-26483

An issue was discovered in Veritas InfoScale Operations Manager VIOM before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. A reflected cross-site scripting XSS vulnerability in admin/cgi-bin/listdir.pl allows authenticated remote administrators to inject arbitrary web script or HTML into an HTTP...

GHSA-J8JP-9X42-4PJ5 Unrestricted Upload of File with Dangerous Type in MODX Revolution

MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator...

Unrestricted Upload of File with Dangerous Type in MODX Revolution

MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator...

CVE-2022-26149

MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator...

CVE-2022-26149

MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator...

CVE-2021-23261

Authenticated administrators may override the system configuration file and cause a denial of service...

CVE-2021-23262

Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE...

Design/Logic Flaw

Authenticated administrators may override the system configuration file and cause a denial of service...

CVE-2021-23262: Improper Control of Dynamically-Managed Code Resources

Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE...

PT-2021-15421

Name of the Vulnerable Software and Affected Versions Software affected versions not specified Description The issue allows authenticated administrators to override the system configuration file, which can cause a denial of service. Recommendations At the moment, there is no information about a...

in marcoax/magutticms

Description RCE via 'upload file image or document' on maguttiCms 8.62 allows remote authenticated administrators to execute arbitrary PHP code Proof of Concept // PoC.req POST /admin/api/uploadifiveSingle HTTP/1.1 Host: 127.0.0.1:8000 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15;...

Tenable Network Security Nessus 输入验证错误漏洞

Tenable Network Security Nessus is an open source system vulnerability scanner from Tenable Network Security. Tenable Network Security Nessus Agent suffers from an input validation error vulnerability that stems from Nessus Agent version 8.3.0 and earlier versions were found to contain multiple...