CVE-2023-38989

Jeesite v1.2.6 has a vulnerability in the delete function of the UserController that allows authenticated attackers to arbitrarily delete the Administrator’s role information. Multiple sources (NVD, RH, OSV, CVE lists, and PTSecurity) confirm the affected software/version and the underlying issue...

CVE-2023-38989

An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role information...

CVE-2023-38989

An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role information...

CVE-2023-38988

An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by Administrators...

Information disclosure

An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by Administrators...

CVE-2023-38988

An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by Administrators...

CVE-2023-38988

CVE-2023-38988 – jeesite 1.2.6 exposes a flaw in the delete function of the OaNotifyController that allows authenticated attackers to arbitrarily delete administrator-created notifications. The issue is documented across multiple sources (NVD/Red Hat/RH and others) with a reported CVSS v3.1 base ...

CVE-2023-38988

An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by Administrators...

CVE-2023-38988

An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by Administrators...

CVE-2023-37598

A Cross Site Request Forgery CSRF vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete new virtual fax function...

Improper Access Control

admidio/admidio is vulnerable to Improper Access Control. The vulnerability exists in the delete function of messages.php which allows an attacker to perform unauthorized message deletions...

CSRF in the delete notification function

Description The web application is vulnerable to CSRF in the delete notification function. Proof of Concept Step 1: See that user demo has some notifications. Step 2: Host an HTML trap page and send the URL to the victim history.pushState'', '', '/' document.forms0.submit; And the malicious URL...

PT-2023-21361 · Bloofox · Bloofox

Name of the Vulnerable Software and Affected Versions: bloofox version 0.5.2 Description: The issue is related to an arbitrary file deletion vulnerability. This vulnerability can be exploited via the delete file function. Recommendations: For bloofox version 0.5.2, consider disabling the delete...

Sql injection

SQL injection vulnerability found in PHPMyWind v.5.6 allows a remote attacker to gain privileges via the delete function of the administrator management page...

CVE-2020-21060: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability found in PHPMyWind v.5.6 allows a remote attacker to gain privileges via the delete function of the administrator management page...

CVE-2020-21060

SQL injection vulnerability found in PHPMyWind v.5.6 allows a remote attacker to gain privileges via the delete function of the administrator management page...

CVE-2023-1589

A vulnerability has been found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This vulnerability affects the function exec of the file admin/operations/approvedelete.php. The manipulation of the argument id leads to sql injection. The attack can be...

Helm和Helmet Store Showroom Site SQL注入漏洞

Helmet Store Showroom Site is a platform by Carlo Montero Personal Developer. Allows potential customers of Inquiries Stores to virtually display helmet products. Helmet Store Showroom Site v1.0 suffers from a SQL injection vulnerability that originates from an SQL injection via...

Online Diagnostic Lab Management System SQL注入漏洞

Online Diagnostic Lab Management System is an online diagnostic lab management system. A security vulnerability exists in Online Diagnostic Lab Management System v1.0, which stems from the id parameter of its /odlms/classes/Users.php?f=delete component that allows an attacker to implement SQL...

OpenCats SQL注入漏洞

OpenCats is an open source recruitment process management system. OpenCats v0.9.6 suffers from a SQL injection vulnerability that stems from a security issue with the tagid variable in the tag delete function. No detailed vulnerability details are provided at this time...