CVE-2023-26998

CVE-2023-26998 affects NetScout nGeniusOne 6.3.4. The vulnerability is a Cross Site Scripting issue in the Alert Configuration page, exploitable via the creator parameter, enabling a remote attacker to execute arbitrary code. Root cause relates to unsanitized input in the creator field. No offici...

PT-2024-12119

Name of the Vulnerable Software and Affected Versions NetScoutnGeniusOne version 6.3.4 Description A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the creator parameter of the "Alert Configuration" page. This enables the attacker to perform unauthorized actions...

CVE-2023-21416

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-Service attack allowing for an attacker to block access to the overlay configuration page in the web interface of the Axis device. This flaw can only be exploited...

HTML Injection

slurm-wlm is vulnerable to Race Condition. This vulnerability allows an attacker who has access to the plugin's configuration page to inject malicious HTML into the page. This malicious HTML could then be executed by users who visit the configuration page, which could allow the attacker to steal...

CVE-2023-38423

A cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2021-4360

The CVE-2021-4360 affects the WordPress plugin Controlled Admin Access. Affected versions are up to and including 1.5.5, where the configuration page is not properly restricted, enabling privilege escalation by creating a new administrator role with unrestricted access. Impact is privilege escala...

CVE-2021-4360

The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting access to the configuration page. This makes it possible for attackers to create a new administrator role with unrestricted access...

PT-2023-12469 · WordPress · Controlled Admin Access

Name of the Vulnerable Software and Affected Versions: Controlled Admin Access plugin for WordPress versions up to, and including, 1.5.5 Description: The issue allows for Privilege Escalation by not properly restricting access to the configuration page, making it possible for attackers to create ...

Code injection

An issue was found in Genesys CIC Polycom phone provisioning TFTP Server all version allows a remote attacker to execute arbitrary code via the login crednetials to the TFTP server configuration page...

PT-2023-22483 · Genesys · Genesys Cic Polycom Phone Provisioning Tftp Server

Name of the Vulnerable Software and Affected Versions: Genesys CIC Polycom phone provisioning TFTP Server affected versions not specified Description: An issue was found that allows a remote attacker to execute arbitrary code via the login credentials to the TFTP server configuration page...

Genesys CIC Polycom phone provisioning TFTP Server 代码问题漏洞

The Genesys CIC Polycom phone provisioning TFTP Server is a server from Genesys Corporation, USA. A security vulnerability exists in the Genesys CIC Polycom phone provisioning TFTP Server that originates from a vulnerability that could allow a remote attacker to execute arbitrary code via login...

CVE-2022-48311

UNSUPPORTED WHEN ASSIGNED Cross Site Scripting XSS in HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model Number A9U23B allows authenticated attacker to inject their own script into the page via HTTP configuration page. NOTE: This vulnerability only affects products tha...

HP Deskjet 2540 跨站脚本漏洞

The HP Deskjet 2540 is a printer from Hewlett-Packard HP in the United States. A cross-site scripting vulnerability exists in the HP Deskjet 2540 Printer series version CEP1FN1418BR, which stems from the presence of cross-site scripting XSS that allows authenticated attackers to inject their own...

PT-2023-12288 · Tpcms · Tpcms

Name of the Vulnerable Software and Affected Versions: tpcms version 3.2 Description: A Cross Site Scripting XSS issue allows remote attackers to run arbitrary code via the cfg copyright or cfg tel field in the Site Configuration page. This enables attackers to execute malicious scripts on the...

CVE-2022-44952

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in /index.php?module=configuration/application. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Copyright Text field after clicking "Ad...

Cross site request forgery (csrf)

A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OPV3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross site request forgery CSRF attack to enable syslog mode through ' /mgmlogcfg.asp.' The system starts to log events, 'Remote' mode or 'Both...

PT-2022-26577 · Unknown · Comserver Series

Name of the Vulnerable Software and Affected Versions: ComServer Series affected versions not specified Description: The issue allows an authenticated remote attacker to execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage. This is a...

Simple Exam Reviewer Management System 代码问题漏洞

Simple Exam Reviewer Management System is a simple examiner management system. version 1.0 of Simple Exam Reviewer Management System is vulnerable to arbitrary file uploads, which stem from the lack of valid authentication of uploaded files on the configuration file page. An authenticated attacke...

CVE-2021-39190

The SCCM plugin for GLPI is a plugin to synchronize computers from SCCM version 1802 to GLPI. In versions prior to 2.3.0, the Configuration page is publicly accessible in read-only mode. This issue is patched in version 2.3.0. No known workarounds exist...

PT-2022-10890 · Glpi · Sccm Plugin For Glpi

Name of the Vulnerable Software and Affected Versions: SCCM plugin for GLPI versions prior to 2.3.0 Description: The SCCM plugin for GLPI has an issue where the Configuration page is publicly accessible in read-only mode in versions prior to 2.3.0. This issue is patched in version 2.3.0...