CVE-2021-3133

The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages...

CVE-2021-3133

The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages...

CVE-2021-21465

The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection...

CVE-2021-21465

The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection...

Flawed Logic Vulnerability in YunMok Backend

YUNMOK adopts PHP + MYSQL as the programming language, through the module and visualization to achieve a technology-free website management operations, users are free to use, and the module can be freely edited, the template can be switched at will. YunMok backend has a logic flaw vulnerability,...

Logic flaw vulnerability in Waychar enrollment system backend

Waychar Registration System is a free race registration system. A logic flaw vulnerability exists in the backend of the Waychar registration system. An attacker can exploit this vulnerability to log directly into the backend...

CVE-2020-25680

A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore file's ID is 'unknown'. The validation of the certificate whether CN and hostname are matching stopped working and allow connecting to the back-end work. The highest threat from...

Acronis: SSRF when configuring Website Backup on Acronis Cloud

Hi, I hope everything goes well. I have found a SSRF in https://mc-beta-cloud.acronis.com/ui//backup-console/resources when configuring the backup plan for a website. Summary While I was looking at the functionality of managing backups on websites, I saw that if you specify a local IP where to ge...

SQL Injection Vulnerability in Douxin Backend

douchat douxin is an open source framework that focuses on the development of WeChat. Douxin backend has a SQL injection vulnerability that can be exploited by attackers to obtain sensitive database information...

SQL injection vulnerability in SeaCMS backend (CNVD-2021-03456)

SeaCMS Ocean CMS is a web content management system based on PHP+MYSQL architecture and supports cross-platform operation. A SQL injection vulnerability exists in the backend of SeaCMS. Attackers can use the vulnerability to obtain sensitive information in the database...

SQL injection vulnerability in SeaCMS backend (CNVD-2021-03455)

SeaCMS Ocean CMS is a web content management system based on PHP+MYSQL architecture and supports cross-platform operation. A SQL injection vulnerability exists in the backend of SeaCMS. Attackers can use the vulnerability to obtain sensitive information in the database...

Zoom Meeting Connector 4.6.239.20200613 - Remote Root Exploit (Authenticated)

Exploit Title: Zoom Meeting Connector 4.6.239.20200613 - Remote Root Exploit Authenticated Date: 12-29-2020 Exploit Author: Jeremy Brown Vendor Homepage: https://support.zoom.us/hc/en-us/articles/201363093-Deploying-the-Meeting-Connector Software Link:...

Joomla! SQL Injection Vulnerability (CNVD-2020-75070)

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A SQL injection vulnerability exists in the back-end user list of Joomla! 3.0.0 -...

HedgeDoc File Upload Vulnerability

Hedgedoc is a Javascript-based Markdown document real-time editing and sharing platform by the Hedgedoc team. A file upload vulnerability exists in versions prior to HedgeDoc 1.7.1, which can be exploited by an unauthenticated attacker to upload arbitrary files to the upload storage backend,...

CVE-2020-35614

An issue was discovered in Joomla! 3.9.0 through 3.9.22. Improper handling of the username leads to a user enumeration attack vector in the backend login page...

CVE-2020-35613

An issue was discovered in Joomla! 3.0.0 through 3.9.22. Improper filter blacklist configuration leads to a SQL injection vulnerability in the backend user list...

CVE-2020-35614

An issue was discovered in Joomla! 3.9.0 through 3.9.22. Improper handling of the username leads to a user enumeration attack vector in the backend login page...

Sql injection

An issue was discovered in Joomla! 3.0.0 through 3.9.22. Improper filter blacklist configuration leads to a SQL injection vulnerability in the backend user list...

Input validation

An issue was discovered in Joomla! 3.9.0 through 3.9.22. Improper handling of the username leads to a user enumeration attack vector in the backend login page...

CVE-2020-35614 [20201105] - Core - User Enumeration in backend login

An issue was discovered in Joomla! 3.9.0 through 3.9.22. Improper handling of the username leads to a user enumeration attack vector in the backend login page...