CVE-2026-41875 Cross-Site Request Forgery in admin panel of Quick.Cart

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

CVE-2026-41875 Cross-Site Request Forgery in admin panel of Quick.Cart

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

CVE-2026-41875

The Quick.Cart software contains a Cross-Site Request Forgery (CSRF) vulnerability within the admin config panel . An attacker can craft a malicious website that, when visited by an administrator, automatically sends a POST request to modify the administrator's login credentials and password. Whi...

EUVD-2026-88741

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

CVE-2025-49132

CVE-2025-49132 - Exploit del Panel de Pterodactyl ⚠️ Aviso : Este repositorio se crea solo con fines educativos y de investigación como parte de mi investigación de seguridad para entender y documentar CVE-2025-49132. Todo el crédito por el descubrimiento de la vulnerabilidad corresponde al...

CVE-2024-34832

CubeCart - Directory Traversal Puede Conducir a RCE CVE-2024-34832 TL;DR En el panel de administración, parámetros como g y node se utilizan para construir la ruta con la que se incluyen archivos .inc.php y se ejecuta código PHP. Un usuario malintencionado con la capacidad de subir archivos...

CVE-2020-13889

Autor: Andre k Lorenci Contacto: [email protected] CVE-2020-13889 Hola, esta vulnerabilidad consiste en una función llamada showAlert en el panel de administración de bludit que, al ser invocada desde el DOM, permite a los usuarios definir el texto que se mostrará en el cuadro de mensaje. Pe...

CVE-2026-54477

CVE-2026-54477: Admin Panel Missing Security Headers clickjacking / XSS Advisory Field| Value ---|--- CVE| CVE-2026-54477 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.4 Medium Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Vector 4.0|...

CVE-2019-20059

CVE-2019-20059 Yetishare SQL Injection in sSortDir0 parameter - v3.5.2 - v4.5.4. Apart from an admin being able to exploit this, it could also be used in a CSRF attack to trick an admin user into running malicious queries. Files affected paymentmanage.ajax.php paymentsubscriptionmanage.ajax.php...

DWrwq

Descripción PHPGurukul Online Shopping Portal 2.1 es vulnerable a Cross Site Scripting XSS en /admin/updateorder.php. Resumen de la Vulnerabilidad 1.Tipo de Vulnerabilidad: Cross-Site Scripting Almacenado XSS 2.Producto Afectado: Online Shopping Portal Project - 2.1 3.Componente Afectado:...

CVE-2026-55579

CVE-2026-55579 — Pheditor Contraseña Predeterminada Hardcodeada RCE -critical TL;DR: Pheditor todas las versiones se distribuye con una contraseña de administrador predeterminada hardcodeada admin incrustada en su código fuente. No se fuerza el cambio de contraseña en el primer inicio de sesión,...

codoforum

CVE-2020-5842 Vulnerabilidad de XSS almacenado en Codoforum 4.8.3 Listado en: Exploit-db, Cve Mitre y The daily swig Mientras buscaba un software de foro gratuito para nuestra comunidad, encontré Codoforum. Después de instalarlo, nosotros Vyshnav Vizz probamos algunos payloads XSS simples para...

Custom-Nuclei-Templates

Custom Nuclei Templates This collection of Nuclei templates is designed to enhance your security testing capabilities. Made a few custom templates and i might add more as time goes on. Introduction Nuclei is a powerful tool for fast and customizable vulnerability scanning. This repository contain...

CVE-2022-43332

CVE-2022-43332 Cross Site Scripting en WonderCMS Descripción: Una vulnerabilidad de cross-site scripting XSS en Wondercms v3.3.4 permite a posibles atacantes ejecutar scripts web o HTML arbitrarios mediante un payload manipulado inyectado en el campo Título del sitio del Panel de configuración;...

Library panel can be moved into a folder without library panel create permission

An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination...

CVE-2023-43878-RiteCMS-Stored-XSS---MainMenu

Rite CMS v3.0 Múltiples XSS Almacenado Autor: Sergio Descripción: Rite CMS 3.0 está afectado por una vulnerabilidad de Cross-Site Scripting XSS almacenado que permite a los atacantes ejecutar código arbitrario mediante un payload manipulado en Menú Principal - Elementos del Menú de Administración...

CVE-2025-44108-SXSS

CVE-2025-44108 - Vulnerabilidades de Cross-Site Scripting XSS almacenado en FlatPress CMS 1.3.1 Descripción Existe una vulnerabilidad de Cross-Site Scripting XSS almacenado en el panel de administración de Flatpress CMS 1.3.1. Un atacante con privilegios de administrador puede inyectar una carga...

CVE-2026-54674

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...

CVE-2026-54674 Authenticated Command Injection in FreePBX UCP Interface

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...

CVE-2026-54674

The FreePBX open source IP PBX is vulnerable to authenticated command injection in the User Control Panel (UCP) interface prior to versions 16.0.39 and 17.0.7 . The root cause is insufficient sanitization of specific URL parameters, which allows an authenticated user to execute arbitrary commands...