320 matches found
PT-2024-18144 · Megabip · Megabip
Name of the Vulnerable Software and Affected Versions: MegaBIP software versions through 5.09 MegaBIP software all versions Description: The issue allows an attacker to obtain site administrator privileges, including access to the administration panel and the ability to change the administrator...
GHSA-V45M-HXQP-FWF5 verbb/formie Server-Side Template Injection for variable-enabled settings
Impact Users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a submission, or rendering the text. This is listed as low-medium severity due to...
verbb/formie Server-Side Template Injection for variable-enabled settings
Impact Users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a submission, or rendering the text. This is listed as low-medium severity due to...
CVE-2024-22179: Authentication Bypass by Assumed-Immutable Data
The application is vulnerable to an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving her access to the admin panel. Also vulnerable to account takeover and arbitrary password change...
PT-2024-23294 · Unknown · Nextcloudpi
Name of the Vulnerable Software and Affected Versions: NextcloudPi versions prior to 1.53.1 Description: A command injection issue in NextcloudPi allows command execution as the root user via the NextcloudPi web-panel. This can be exploited by anyone with access to the web-panel, as no...
CVE-2024-1623
Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the 'Login.asp and logout.asp' files do not...
GHSA-XRVH-RVC4-5M43 Kirby vulnerable to unrestricted file upload of user avatar images
TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users. The attack requires user interaction by another user or visitor and cannot be automated. ---- Introduction Unrestricted upload of files with a dangerous type is a type o...
CVE-2024-24721
An issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack through which an attacker may be able to access the administration panel...
CVE-2024-24721: Improper Restriction of Excessive Authentication Attempts
An issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack through which an attacker may be able to access the administration panel...
PT-2024-21398 · Kirby Cms · Kirby Cms
Name of the Vulnerable Software and Affected Versions: Kirby CMS version 4.1.0 Description: A reflected self-XSS vulnerability was discovered in Kirby CMS via the URL parameter. This issue can be exploited when a user is tricked into executing malicious JavaScript code within their own context,...
TELSAT marKoni FM Transmitter 1.9.5 Backdoor Account
TELSAT marKoni FM Transmitter 1.9.5 Backdoor Account Vendor: TELSAT Srl Product web page: https://www.markoni.it Affected version: Markoni-D Compact FM Transmitters Markoni-DH Exciter+Amplifiers FM Transmitters Markoni-A Analogue Modulator FM Transmitters Firmware: 1.9.5 1.9.3 1.5.9 1.4.6 1.3.9...
CVE-2023-6768
Authentication bypass vulnerability in Amazing Little Poll affecting versions 1.3 and 1.4. This vulnerability could allow an unauthenticated user to access the admin panel without providing any credentials by simply accessing the "lpadmin.php?adminstep=" parameter...
CVE-2023-6768
CVE-2023-6768 affects Amazing Little Poll versions 1.3 and 1.4. It describes an authentication bypass where an unauthenticated user can reach the admin panel by accessing the lp_admin.php?adminstep= parameter, enabling unauthorized access to sensitive admin functionality. The vulnerability is dem...
CVE-2023-6768: Improper Authentication
Authentication bypass vulnerability in Amazing Little Poll affecting versions 1.3 and 1.4. This vulnerability could allow an unauthenticated user to access the admin panel without providing any credentials by simply accessing the "lpadmin.php?adminstep=" parameter...
Amazing Little Poll License Issue Vulnerability
Amazing Little Poll is Amazing Little Poll open source a very simple php voting script. An authorization issue vulnerability exists in Amazing Little Poll version 1.3, 1.4. An attacker can exploit this vulnerability to access the admin panel by bypassing authentication...
PT-2023-32769 · Unknown · Amazing Little Poll
Name of the Vulnerable Software and Affected Versions: Amazing Little Poll versions 1.3 through 1.4 Description: The issue allows an unauthenticated user to access the admin panel without providing any credentials by accessing the "lp admin.php?adminstep=" parameter. This could enable unauthorize...
VulnCheck KEV: CVE-2022-36642
A local file disclosure vulnerability in /appConfig/userDB.json of Telos Alliance Omnia MPX Node through 1.0.0-1.4.9 allows attackers to access users credentials which makes him able to gain initial access to the control panel with high privilege because the cleartext storage of sensitive...
PT-2023-6361 · Connectize · Connectize Ac21000 G6
Name of the Vulnerable Software and Affected Versions: Connectize AC21000 G6 version 641.139.1.1256 Description: The issue is related to a Cross Site Scripting XSS vulnerability that allows attackers to run arbitrary code via a crafted string when setting the Wi-Fi password in the admin panel. Th...
PT-2023-28748 · Milesight · Milesight Ur32L +3
Name of the Vulnerable Software and Affected Versions: Milesight UR5X, UR32L, UR32, UR35, UR41 versions prior to 35.3.0.7 Description: A cross-site scripting XSS issue was discovered in the admin panel of the affected devices. This issue allows for malicious scripts to be injected into the websit...
