Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled

Impact When a user disables two-factor authentication via the Panel, a DELETE request with their current password in a query parameter will be sent. While query parameters are encrypted when using TLS, many webservers including ones officially documented for use with Pterodactyl will log query...

CVE-2024-45242

EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2c1.9.51 allow blind OS Command Injection via shell metacharacters to the Ping or Speed Test utility. During the time of initial setup, the device creates an open unsecured network whose admin panel is configured with the default credential...

PHPGurukul Boat Booking System SQL注入漏洞

PHPGurukul Boat Booking System is a boat booking system from PHPGurukul. A SQL injection vulnerability exists in PHPGurukul Boat Booking System version 1.0, which originates from a SQL injection vulnerability in the username parameter of the /admin/index.php page of the Sign In Page component...

SourceCodester Online Eyewear Shop Website 跨站脚本漏洞

SourceCodester Online Eyewear Shop is a SourceCodester open source online eyewear store website project developed using PHP and MySQL, which provides an online shopping and ordering platform for the eyewear business and its potential customers. A cross-site scripting vulnerability exists in...

Malicious code in sukuna-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40c28070648a48cc88a94d5ad2595df8a698f689504e6dbd8f3800fa2e84f658 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9254 Malicious code in sukuna-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40c28070648a48cc88a94d5ad2595df8a698f689504e6dbd8f3800fa2e84f658 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MD-Pro 1.0.76 Shell Upload / SQL Injection Vulnerability

Exploit Title: MD-Pro 1.0.76. SQL injection + shell upload Google Dork: intext: Powered by MD-Pro Exploit Author: Emiliano Febbi Vendor Homepage: https://www.opensourcecms.com/wp-content/uploads/MDPro-website-description.png Software Link: https://www.opensourcecms.com/mdpro/ Version: 1.0.76...

Cross-site Scripting (XSS)

Pagekit is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper input sanitization in the widget management feature of the admin panel index.php/admin/site/widget, allowing attackers to inject malicious scripts...

MD-Pro 1.0.76 Shell Upload / SQL Injection

Exploit Title: MD-Pro 1.0.76. SQL injection + shell upload Google Dork: intext: Powered by MD-Pro Date: 2024-08-30 Exploit Author: Emiliano Febbi Vendor Homepage: https://www.opensourcecms.com/wp-content/uploads/MDPro-website-description.png Software Link: https://www.opensourcecms.com/mdpro/...

Synology DiskStation Manager Improper Neutralization of Input During Web Page Generation (CVE-2018-13293)

Cross-site scripting XSS vulnerability in Control Panel SSO Settings in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter. This plugin only works with Tenable.ot. Please visit...

Cross-site Scripting (XSS)

NetBox is vulnerable to stored cross-site scripting XSS. The vulnerability is due to improper sanitization in the "Top banner" field within the "Configuration History" feature of the "Admin" panel, allowing an authenticated user to inject arbitrary JavaScript or HTML...

CVE-2024-9326

A vulnerability classified as critical was found in PHPGurukul Online Shopping Portal 2.0. This vulnerability affects unknown code of the file /shopping/admin/index.php of the component Admin Panel. The manipulation of the argument username leads to sql injection. The attack can be initiated...

CVE-2024-9326

A vulnerability classified as critical was found in PHPGurukul Online Shopping Portal 2.0. This vulnerability affects unknown code of the file /shopping/admin/index.php of the component Admin Panel. The manipulation of the argument username leads to sql injection. The attack can be initiated...

CVE-2024-9326 PHPGurukul Online Shopping Portal Admin Panel index.php sql injection

A vulnerability classified as critical was found in PHPGurukul Online Shopping Portal 2.0. This vulnerability affects unknown code of the file /shopping/admin/index.php of the component Admin Panel. The manipulation of the argument username leads to sql injection. The attack can be initiated...

CVE-2024-9326 PHPGurukul Online Shopping Portal Admin Panel index.php sql injection

A vulnerability classified as critical was found in PHPGurukul Online Shopping Portal 2.0. This vulnerability affects unknown code of the file /shopping/admin/index.php of the component Admin Panel. The manipulation of the argument username leads to sql injection. The attack can be initiated...

CVE-2024-9326

PHPGurukul Online Shopping Portal 2.0 Admin Panel has a SQL injection vulnerability in /shopping/admin/index.php, triggered by manipulating the username parameter. Remote exploitation is possible and public exploits have been disclosed. Affected component is the Admin Panel logic handling the use...

PT-2024-39575 · Unknown · Phpgurukul Online Shopping Portal

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Shopping Portal version 2.0 Description: A critical vulnerability was found in the Admin Panel component of the PHPGurukul Online Shopping Portal, specifically affecting the file /shopping/admin/index.php. The manipulation o...

Online Shopping Portal SQL注入漏洞

Online Shopping Portal is an open source online shopping portal from the individual developer Anuj Kumar. A SQL injection vulnerability exists in Online Shopping Portal version 2.0, which originates from an SQL injection issue in the username parameter of the /shopping/admin/index.php page of the...

Exploit for Cross-site Scripting in Flatpress

CVE-2024-33209 FlatPress 1.3. is vulnerable to Cross Site Scri...

Seo Panel 4.10.0 Remote File Inclusion

==================================================================================================================================== | Title : Seo Panel 4.10.0 File inclusion Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64 bits | | Vend...