PT-2024-33121 · Unknown · Teslalogger

Name of the Vulnerable Software and Affected Versions: TeslaLogger versions prior to 1.59.6 Description: A Cross Site Scripting issue in the Admin Panel allows a remote attacker to execute arbitrary code via the New Journey field. Recommendations: For versions prior to 1.59.6, update to version...

CVE-2024-48461: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in TeslaLogger Admin Panel before v.1.59.6 allows a remote attacker to execute arbitrary code via the New Journey field...

CVE-2024-10446 Project Worlds Online Time Table Generator admindashboard.php sql injection

A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. Affected is an unknown function of the file /timetable/admin/admindashboard.php?info=addcourse. The manipulation of the argument c leads to sql injection. It is possible to launch the attack...

CVE-2024-48291

dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery CSRF via /admin/doAdminAction.php?act=editAdmin&id=17...

CVE-2024-48191

dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/doAdminAction.php?act=delAdmin&id=17...

CVE-2024-48191

The dingfanzu CMS 1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability within the /admin/doAdminAction.php?act=delAdmin&id=17 component. This flaw allows an attacker to perform unauthorized actions on the platform. As of the current documentation, there is no official patch available. T...

CVE-2024-49762 Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled

Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a DELETE request with their current password in a query parameter will be sent. While query parameters are encrypted when using TLS, many webservers including ones...

CVE-2024-49762 Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled

Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a DELETE request with their current password in a query parameter will be sent. While query parameters are encrypted when using TLS, many webservers including ones...

CVE-2024-49762 Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled

Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a DELETE request with their current password in a query parameter will be sent. While query parameters are encrypted when using TLS, many webservers including ones...

CVE-2024-45242

EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2c1.9.51 allow blind OS Command Injection via shell metacharacters to the Ping or Speed Test utility. During the time of initial setup, the device creates an open unsecured network whose admin panel is configured with the default credential...

Cleartext Storage in a File or on Disk

Overview pterodactyl/panel is a game management panel. Affected versions of this package are vulnerable to Cleartext Storage in a File or on Disk due to the logging of sensitive information in plain text when two-factor authentication is disabled. An attacker can potentially gain unauthorized...

GHSA-C479-WQ8G-57HR Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled

Impact When a user disables two-factor authentication via the Panel, a DELETE request with their current password in a query parameter will be sent. While query parameters are encrypted when using TLS, many webservers including ones officially documented for use with Pterodactyl will log query...

Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled

Impact When a user disables two-factor authentication via the Panel, a DELETE request with their current password in a query parameter will be sent. While query parameters are encrypted when using TLS, many webservers including ones officially documented for use with Pterodactyl will log query...

CVE-2024-45242

EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2c1.9.51 allow blind OS Command Injection via shell metacharacters to the Ping or Speed Test utility. During the time of initial setup, the device creates an open unsecured network whose admin panel is configured with the default credential...

PHPGurukul Boat Booking System SQL Injection Vulnerability

PHPGurukul Boat Booking System is a boat booking system from PHPGurukul. A SQL injection vulnerability exists in PHPGurukul Boat Booking System version 1.0, which originates from a SQL injection vulnerability in the username parameter of the /admin/index.php page of the Sign In Page component...

SourceCodester Online Eyewear Shop Website Cross-site Script Vulnerability

SourceCodester Online Eyewear Shop is a SourceCodester open source online eyewear store website project developed using PHP and MySQL, which provides an online shopping and ordering platform for the eyewear business and its potential customers. A cross-site scripting vulnerability exists in...

MAL-2024-9254 Malicious code in sukuna-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40c28070648a48cc88a94d5ad2595df8a698f689504e6dbd8f3800fa2e84f658 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sukuna-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40c28070648a48cc88a94d5ad2595df8a698f689504e6dbd8f3800fa2e84f658 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in sukuna-panel

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

PT-2024-41507

Уязвимость веб-панели управления многофункционального устройства МФУ Катюша М348 связана с нарушением механизма защиты данных. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, раскрыть защищаемую информацию...