25 matches found
EUVD-2023-46062
Malicious code in bioql PyPI...
EUVD-2021-28109
Malicious code in bioql PyPI...
PT-2025-29922 · Unknown · Oa Ekp Version 16
Name of the Vulnerable Software and Affected Versions: OA EKP version 16 Description: OA EKP version 16 contains an arbitrary download vulnerability within the /ui/sys ui extend/sysUiExtend.do component. This issue allows attackers to obtain the background administrator password and subsequently...
CVE-2018-14583
xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account...
CVE-2025-25960
The phpcmsv9 content management system (version 9.6.3 ) is susceptible to a Cross-Site Scripting (XSS) vulnerability. A remote attacker can exploit this flaw via the menu interface of the member center within the background administrator panel to escalate privileges . To mitigate this risk, users...
PT-2025-7590 · Phpcmsv9 · Phpcmsv9
Name of the Vulnerable Software and Affected Versions: phpcmsv9 version 9.6.3 Description: The issue allows a remote attacker to escalate privileges via the menu interface of the member center of the background administrator. This is a Cross-Site Scripting issue. Recommendations: For phpcmsv9...
CVE-2021-40955
SQL injection exists in LaiKetui v3.5.0 the background administrator list...
CVE-2021-40955: Improper Neutralization of Special Elements used in an SQL Command
SQL injection exists in LaiKetui v3.5.0 the background administrator list...
CVE-2021-37270: Missing Authorization
There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0. Attackers can use this vulnerability to directly access the specified background path without logging in to the background to obtain the background administrator authority...
PT-2021-21597
Name of the Vulnerable Software and Affected Versions CMS Enterprise Website Construction System version 5.0 Description The issue allows attackers to gain unauthorized access to the background administrator authority without logging in. This is achieved by directly accessing a specified backgrou...
CVE-2020-21082: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in the background administrator article management module of Maccms 8.0 allows attackers to steal administrator and user cookies via crafted payloads in the text fields for Chinese and English names...
CVE-2019-11624
doorGets 7.0 has an arbitrary file deletion vulnerability in /doorgets/app/requests/user/configurationRequest.php. A remote background administrator privilege user can exploit this vulnerability to delete arbitrary files...
CVE-2019-11625
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/emailingRequest.php. A remote background administrator privilege user or a user with permission to manage emailing could exploit the vulnerability to obtain database sensitive information...
Sql injection
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=network. A remote background administrator privilege user or a user with permission to manage network configuration could exploit the vulnerability to obtain database sensitive...
Arbitrary file deletion
doorGets 7.0 has an arbitrary file deletion vulnerability in /doorgets/app/requests/user/configurationRequest.php. A remote background administrator privilege user can exploit this vulnerability to delete arbitrary files...
CVE-2019-11619
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=analytics. A remote background administrator privilege user or a user with permission to manage configuration analytics could exploit the vulnerability to obtain database sensitive...
CVE-2019-11623: Improper Neutralization of Special Elements used in an SQL Command
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=siteweb. A remote background administrator privilege user or a user with permission to manage configuration siteweb could exploit the vulnerability to obtain database sensitive...
CVE-2019-11621: Improper Neutralization of Special Elements used in an SQL Command
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=network. A remote background administrator privilege user or a user with permission to manage network configuration could exploit the vulnerability to obtain database sensitive...