PT-2023-23296

Name of the Vulnerable Software and Affected Versions: Protect WP Admin WordPress plugin versions prior to 4.0 Description: The issue allows an attacker to disclose the URL of the admin panel via a redirection of a crafted URL, effectively bypassing the protection offered by the plugin...

PT-2023-3483 · 1Panel · 1Panel

Name of the Vulnerable Software and Affected Versions: 1Panel versions prior to 1.3.6 Description: The issue is related to command injection when entering the container terminal in 1Panel, an open source Linux server operation and maintenance management panel. An authenticated attacker can craft...

CBOT Chatbot 安全特征问题漏洞

CBOT Chatbot is an AI-powered real-time chat solution from CBOT. A security signature issue vulnerability exists in CBOT Chatbot Core prior to v4.0.3.4, Panel prior to v4.0.3.7, which stems from the use of Cryptographically Weak Pseudo-Random Number Generator PRNG, which allows signature spoofing...

CBOT Chatbot 安全漏洞

CBOT Chatbot is an AI-powered real-time chat solution from CBOT. A security vulnerability exists in CBOT Chatbot Core prior to v4.0.3.4, Panel prior to v4.0.3.7, which stems from a vulnerability that allows bypassing authentication...

SourceCodester Online Exam System SQL注入漏洞

Online Exam System is an online exam system by oretnom23 individual developers. SourceCodester Online Exam System version 1.0 suffers from a SQL injection vulnerability that originates from a problem in the file adminpanel/admin/faceboxmodal/updateCourse.php, where manipulation of the parameter i...

Cross site scripting

A stored cross-site scripting XSS vulnerability in DouPHP v1.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the uniqueid parameter in /admin/article.php...

The vulnerability of the Trace View web instrumentation panel in Grafana allows attackers to escalate their privileges and perform cross-site scripting attacks.

The vulnerability of the Trace View web instrumentation panel in Grafana relates to insufficient protection of the web page structure when processing values of attributes and resources within a range. Exploiting this vulnerability allows an attacker to enhance their privileges and perform...

Hardcoded credentials

A Hard Coded Admin Credentials issue in the Web-UI Admin Panel in Propius MachineSelector 6.6.0 and 6.6.1 allows remote attackers to gain access to the admin panel Propiusadmin.php, which allows taking control of the affected system...

Control iD Panel 跨站脚本漏洞

Control iD Panel is a web application. Control iD Panel suffers from a cross-site scripting vulnerability that stems from incorrect manipulation of the Nome parameter leading to cross-site scripting...

PT-2023-16029 · Unknown · Control Id Panel +1

Name of the Vulnerable Software and Affected Versions: Control iD Gerencia Web version 1.30 Control iD Panel affected versions not specified Description: A vulnerability was found in the Web Interface component, where the manipulation of the Nome argument leads to cross-site scripting. The attack...

CVE-2022-36784 Elsight – Elsight Halo Remote Code Execution (RCE)

Elsight – Elsight Halo Remote Code Execution RCE Elsight Halo web panel allows us to perform connection validation. through the POST request : /api/v1/nics/wifi/wlan0/ping we can abuse DESTINATION parameter and leverage it to remote code execution...

PT-2022-12942 · Unknown · Vesta Control Panel

Name of the Vulnerable Software and Affected Versions: myVesta Control Panel versions prior to 0.9.8-26-43 Vesta Control Panel versions prior to 0.9.8-26 Description: The issue allows an authenticated and remote administrative user to execute arbitrary commands. This can be achieved by sending HT...

CVE-2022-41406

CVE-2022-41406 concerns an arbitrary file upload vulnerability in Church Management System v1.0, specifically the /admin/admin_pic.php component, allowing an attacker to execute arbitrary code via a crafted PHP file. The CVSS data in the entry indicates high impact (Confidentiality, Integrity, Av...

Online Tours & Travels Management System SQL注入漏洞

Online Tours ＆ Travels Management System is an online travel management system by Mayuri K Personal Developer. A SQL injection vulnerability exists in Online Tours & Travels Management System version v1.0 due to a lack of validation of externally-entered SQL statements in the id parameter of its...

ZZCMS SQL注入漏洞

ZZCMS is a content management system CMS by the ZZCMS team in China. A security vulnerability exists in ZZCMS 2019 version, which can be exploited by an attacker to perform a SQL injection attack via the id parameter in /admin/dlsendmail.php...

Sql injection

Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\packageedit.php...

Sql injection

elitecms 1.01 is vulnerable to SQL Injection via /admin/editsidebar.php...

Carrier LenelS2 HID Mercury access panels 安全漏洞

Carrier LenelS2 HID Mercury access panels is a controller panel from Carrier, Inc. A buffer overflow vulnerability exists in Carrier LenelS2 HID Mercury access panels, which could be exploited by an attacker to send a specially crafted, unauthenticated HTTP request to the device, which can overfl...

CVE-2022-29685

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/User/levelsort...

Cross-site Scripting (XSS) - Stored in microweber/microweber

Description Stored XSS is a vulnerability in which the attacker can execute arbitrary javascript code in the victim's browser. The XSS payload is stored in a webpage and it gets executed whenever someone visits that webpage. Proof of Concept 1 Visit "Contact Us" page and put in Message field. Cli...