320 matches found
CVE-2025-28232
Incorrect access control in the HOME.php endpoint of JMBroadcast JMB0150 Firmware v1.0 allows attackers to access the Admin panel without authentication...
CVE-2025-28232
The JMBroadcast JMB0150 Firmware v1.0 is vulnerable to an improper access control flaw in the HOME.php endpoint. This vulnerability allows an attacker to access the Admin panel without any authentication. The impact is significant as it facilitates unauthorized administrative access. As of the cu...
PT-2025-17304 · Jmbroadcast · Jmbroadcast Jmb0150 Firmware
Name of the Vulnerable Software and Affected Versions: JMBroadcast JMB0150 Firmware version 1.0 Description: The issue is related to incorrect access control in the "HOME.php" endpoint, allowing attackers to access the Admin panel without authentication. Recommendations: For JMBroadcast JMB0150...
CVE-2024-55604
Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to development information of a workspace. Datasources are such a component in a workspace. Yet, in versions of Appsmith prior to 1.51, app viewers are able to get a...
Jasmin Ransomware - SQL Injection Login Bypass
Exploit Title: Jasmin Ransomware SQL Injection Login Bypass Google Dork: N/A Date: 05-03-2025 Exploit Author: Buğra Enis Dönmez Vendor Homepage: https://github.com/codesiddhant/Jasmin-Ransomware Software Link: https://github.com/codesiddhant/Jasmin-Ransomware Version: N/A Tested on: Windows How t...
FluxBB 1.5.11 - Stored Cross-Site Scripting (XSS)
Exploit Title: FluxBB 1.5.11 Stored xss Date: 3/8/2025 Exploit Author: Chokri Hammedi Vendor Homepage: www.fluxbb.org Software Link: https://www.softaculous.com/apps/forums/FluxBB Version: FluxBB 1.5.11 Tested on: Windows XP 1. login to admin panel 2. go to /adminforums.php 3. click on "add forum...
Jasmin Ransomware SQL Injection / Authenticaton Bypass Vulnerability
Exploit Title: Jasmin Ransomware SQL Injection Login Bypass Exploit Author: Buğra Enis Dönmez n3c1 Vendor Homepage: https://github.com/codesiddhant/Jasmin-Ransomware Software Link: https://github.com/codesiddhant/Jasmin-Ransomware Version: N/A Tested on: Windows How to exploit : -- Open Admin Pan...
Formwork improperly validates input of User role preventing site and panel availability
Summary Improper validation of select fields allows attackers to craft an input that crashes the system, resulting in a 500 status and making the entire site and administration panel unavailable. This clearly impacts the Availability aspect of the CIA triad confidentiality, integrity, and...
CVE-2025-22270 Stored XSS in CyberArk Endpoint Privilege Manager
An attacker with access to the Administration panel, specifically the "Role Management" tab, can inject code by adding a new role in the "name" field. It should be noted, however, that the risk of exploiting vulnerability is reduced due to the required additional error that allows bypassing the...
PT-2025-9112 · Adobe · Magento
Name of the Vulnerable Software and Affected Versions: Magento Long Term Support LTS versions prior to 20.12.3 Magento Long Term Support LTS versions prior to 20.13.1 Description: The issue allows script execution in the admin panel, potentially leading to cross-site scripting against authenticat...
CVE-2024-23733
Software AG webMethods API Integration Server version 10.15.0 (specifically version 10.15.0.0000-0092 ) is vulnerable to an Incorrect Access Control flaw. An attacker can reach the administration panel by sending an arbitrary username and a blank password to the /WmAdmin/#/login/ URI. This allows...
CVE-2024-23733
The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before CoreFix7 allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary username and a blank password to the...
CVE-2024-56529
The Mailcow mail server suite (versions through 2024-11b ) is vulnerable to a session fixation vulnerability within the web panel. The root cause is that the application fails to disable old session IDs, allowing a remote attacker to set a session identifier on a victim's browser when HSTS is dis...
Vaultwarden -- Multiple vulnerabilities
The Vaultwarden project reports: RCE in the admin panel. Getting access to the Admin Panel via CSRF. Escalation of privilege via variable confusion in OrgHeaders trait...
PT-2025-1547 · Unknown · Luckywp Scripts Control
Name of the Vulnerable Software and Affected Versions: LuckyWP Scripts Control versions 1.2.1 and earlier Description: The issue is related to a Missing Authorization vulnerability in LuckyWP Scripts Control, which allows exploiting incorrectly configured access control security levels...
Improper Authorization
getkirby/cms is vulnerable to Improper Authorization. The vulnerability is due to the insufficient permission checks in the language settings. An attacker with Panel access can manipulate language definitions by exploiting these missing checks...
Kirby has insufficient permission checks in the language settings
TL;DR This vulnerability affects all Kirby sites with enabled languages option that might have potential attackers in the group of authenticated Panel users. If you have disabled the languages and/or api option and don't call any methods in your code that cause a write access to languages languag...
PT-2024-29666 · Kirby · Kirby
Name of the Vulnerable Software and Affected Versions: Kirby versions prior to 3.6.6.6 Kirby versions prior to 3.7.5.5 Kirby versions prior to 3.8.4.4 Kirby versions prior to 3.9.8.2 Kirby versions prior to 3.10.1.1 Kirby versions prior to 4.3.1 Description: Kirby is a CMS targeting designers and...
Kirby 安全漏洞
Kirby is a file-based content management system CMS from Kirby Open Source. A security vulnerability exists in Kirby that stems from insufficient permission checking in the language settings, allowing an attacker with Panel access to manipulate the language definitions...
CVE-2024-41964: Incorrect Authorization
Kirby is a CMS targeting designers and editors. Kirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted actions. Permissions for creating and deleting languages have already existed and could be configured, but were not enforced by Kirby's...