SQL Injection

1Panel is vulnerable to SQL Injection. The vulnerability is due to improper handling of the User-Agent input, which results in SQL injection...

SQL Injection

1Panel is vulnerable to SQL Injection. The vulnerability is due to insufficient filtering of inputs, leading to arbitrary file writes and remote code executions RCEs...

MAL-2024-7781 Malicious code in angular-material-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cc6ec3d00f5ac0565644d0b1fce06bf68473a14b48df88761451345f12c7475c The OpenSSF Package Analysis project identified 'angular-material-panel' @ 1.1.5 npm as malicious. It is considered malicious because: - The...

Malicious code in angular-material-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cc6ec3d00f5ac0565644d0b1fce06bf68473a14b48df88761451345f12c7475c The OpenSSF Package Analysis project identified 'angular-material-panel' @ 1.1.5 npm as malicious. It is considered malicious because: - The...

CVE-2024-6942

A vulnerability, which was classified as problematic, was found in ThinkSAAS 3.7.0. Affected is an unknown function of the file app/system/action/anti.php of the component Admin Panel Security Center. The manipulation of the argument ip/email/phone leads to cross site scripting. It is possible to...

CVE-2024-6942

ThinkSAAS 3.7.0 Admin Panel Security Center contains a cross-site scripting flaw in file app/system/action/anti.php. Manipulating ip, email, or phone arguments can be exploited remotely; exploit has been disclosed publicly. Multiple connected sources confirm affected software and component. Pract...

CVE-2024-6942 ThinkSAAS Admin Panel Security Center anti.php cross site scripting

A vulnerability, which was classified as problematic, was found in ThinkSAAS 3.7.0. Affected is an unknown function of the file app/system/action/anti.php of the component Admin Panel Security Center. The manipulation of the argument ip/email/phone leads to cross site scripting. It is possible to...

CVE-2024-6942 ThinkSAAS Admin Panel Security Center anti.php cross site scripting

A vulnerability, which was classified as problematic, was found in ThinkSAAS 3.7.0. Affected is an unknown function of the file app/system/action/anti.php of the component Admin Panel Security Center. The manipulation of the argument ip/email/phone leads to cross site scripting. It is possible to...

PT-2024-37980 · Thinksaas · Thinksaas

Name of the Vulnerable Software and Affected Versions: ThinkSAAS version 3.7.0 Description: A problematic issue was found in the Admin Panel Security Center component, specifically in the file app/system/action/anti.php. The manipulation of the ip, email, or phone argument leads to cross-site...

CVE-2024-39907

1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in version 1.10.12-tls. Users are advised to...

CVE-2024-39911 1Panel SQL injection

1Panel is a web-based linux server management control panel. 1Panel contains an unspecified sql injection via User-Agent handling. This issue has been addressed in version 1.10.12-lts. Users are advised to upgrade. There are no known workarounds for this vulnerability...

CVE-2024-39911

CVE-2024-39911 affects 1Panel, a web-based Linux server management control panel. The issue is an unspecified SQL injection via User-Agent handling that can impact confidentiality, integrity, and availability. Red Hat and other sources corroborate the same description and note the fix in version ...

CVE-2024-39907

1Panel is affected by an authenticated SQL injection vulnerability in its web-based Linux server management panel. The connected Nuclei template and related advisories describe multiple SQL injections that are not properly filtered, enabling arbitrary file writes and remote code execution (RCE). ...

1Panel has an SQL injection issue related to the orderBy clause

There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. The proof is as follows...

The vulnerability of the ajaxterm module in the Webmin hosting control panel allows a hacker to intercept the console session.

The vulnerability of the ajaxterm module in the Webmin hosting control panel is related to incorrect handling of permissions or privileges. Exploiting this vulnerability could allow a malicious actor, operating remotely, to intercept the console session...

CVE-2024-40916

In the Linux kernel, the following vulnerability has been resolved: drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found When reading EDID fails and driver reports no modes available, the DRM core adds an artificial 1024x786 mode to the connector. Unfortunately some variant...

WordPress Poll Maker 5.3.2 SQL Injection

Exploit Title: WordPress Poll Maker Plugin SQL Injection Date: 2024-07-11 Exploit Author: tmrswrr Category : Webapps Vendor: https://ays-pro.com/wordpress/poll-maker Version 5.3.2 1. Access the Admin Panel: - Navigate to the admin panel of your WordPress site. - Go to Poll Maker Results...

CVE-2024-27095 Decidim cross-site scripting (XSS) in the admin panel

Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1...

CVE-2024-27095 Decidim cross-site scripting (XSS) in the admin panel

Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1...

CVE-2024-27095 Decidim cross-site scripting (XSS) in the admin panel

Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1...