146 matches found
Creacast Creabox Manager 安全漏洞
Creacast Creabox Manager is a device management system from Creacast France. A security vulnerability exists in Creacast Creabox Manager version 4.4.4, which originates in the edit.php endpoint that allows the injection of arbitrary Lua code, which could lead to remote code execution and full...
CVE-2025-57205
Inilabs School Express (SMS Express) 6.2 is affected by a Stored XSS in content-management editors (POST /posts/edit/{id} and similar for Notices/Pages). The root cause is insufficient input sanitization and output encoding for editor parameters; payloads are saved and later rendered unsanitized,...
CVE-2025-57439
Creacast Creabox Manager 4.4.4 contains a critical Remote Code Execution vulnerability accessible via the edit.php endpoint. An authenticated attacker can inject arbitrary Lua code into the configuration, which is then executed on the server. This allows full system compromise, including reverse...
CVE-2025-57439
CVE-2025-57439 affects Creacast Creabox Manager 4.4.4. The vulnerability is a remote code execution via the edit.php endpoint, where an authenticated attacker can inject arbitrary Lua code into the configuration, resulting in server-side code execution and full system compromise (e.g., reverse sh...
CVE-2025-40690 SQL injection in PHPGurukul Online Fire Reporting System
SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'teamid' parameter in the endpoint '/ofrs/admin/edit-team.php'...
CVE-2025-50989
OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint interfacesbridgeedit.php. The span POST parameter is concatenated into a system-level command without proper sanitization or escaping, allowing an administrator to inject arbitra...
Cross-site Request Forgery (CSRF)
Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the Product edit process and creation endpoints. An attacker can perform unauthorized actions on behalf of authenticated users by tricking them into submitting malicious requests. Remediation Upgrade...
Cross-site Scripting (XSS)
microweber/microweber is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the id parameter in the liveedit.modulesettings API endpoint allowing arbitrary JavaScript execution...
Missing Authentication for Critical Function
Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to an API call to edit the channel subscription endpoint. An attacker can modify channel subscriptions by sending unauthorized API requests. Remediation Upgrade...
CVE-2025-48731 Unauthorized Subscription Edit to Confluence Space in Mattermost Confluence Plugin
Mattermost Confluence Plugin version 1.5.0 fails to check the access of the user to the Confluence space which allows attackers to edit a subscription for a Confluence space the user does not have access for via edit subscription endpoint...
CVE-2025-46203
An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /students/edit/id endpoint...
Unifiedtransform 安全漏洞
Unifiedtransform is an open source school management software by Hasib Mahmud Individual Developer. A security vulnerability exists in Unifiedtransform version v2.0, which stems from the /course/edit/id endpoint vulnerability and could lead to remote elevation of privilege...
CVE-2025-46203
CVE-2025-46203 – Unifiedtransform (v2.0) : The issue stems from incorrect access control on the /students/edit/{id} endpoint, allowing remote users (students/teachers) to escalate privileges and modify other students’ records. Concrete details across connected sources confirm the vulnerable compo...
Unifiedtransform 安全漏洞
Unifiedtransform is an open source school management software by Hasib Mahmud Individual Developer. A security vulnerability exists in Unifiedtransform version v2.0, which stems from the /students/edit/id endpoint vulnerability and could lead to remote elevation of privilege...
📄 Unifiedtransform 2.x Student Editor Missing Authorization
Unifiedtransform version 2.x allows any user to access and modify student records via the /students/edit/id endpoints. Description Unifiedtransform v2.X is vulnerable to Incorrect Access Control. Any user students and teachers can access and modify student records via the /students/edit/id...
📄 Unifiedtransform 2.x Course Editor Missing Authorization
Unifiedtransform version 2.x allows any user to access and modify course records via the /course/edit/id endpoints. Description Unifiedtransform v2.X is vulnerable to Incorrect Access Control. Any user students and teachers can access and modify course details via the /course/edit/id endpoints...
Hope-Boot 安全漏洞
Hope-Boot is a modern scaffolding project by the individual developer java-aodeng. A security vulnerability exists in Hope-Boot v1.0.0, which stems from improper access control in the component /user/edit/ and could lead to bypassing authentication...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the article name field in plugins/content/pages/content.php, accessible over the content/edit endpoint. An attacker can steal cookies and perform session hijacking by injecting malicious scripts. Details...
PT-2025-4117 · Zenvia · Zenvia Movidesk
Name of the Vulnerable Software and Affected Versions: Zenvia Movidesk versions prior to 25.01.22.245a473c54 Description: A problematic issue was found in Zenvia Movidesk, affecting some unknown functionality of the file /Account/EditProfile of the component Profile Editing. The manipulation of t...
PT-2025-3404 · 07Flycms · 07Flycms
Name of the Vulnerable Software and Affected Versions: 07FLYCMS version 1.3.9 Description: A Cross-Site Request Forgery CSRF issue was discovered in 07FLYCMS. The issue occurs via the "/erp.07fly.net:80/oa/OaTask/edit.html" API endpoint. Recommendations: For version 1.3.9, as a temporary...