CVE-2024-22591

FlyCms v1.0 contains a Cross-Site Request Forgery CSRF vulnerability via /system/user/groupsave...

PT-2024-19498 · Flycms · Flycms

Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. It occurs via the "/system/admin/add group save" API endpoint. This allows for potentially unauthorized actions to be performed on behalf of an...

Student Information System SQL Injection Vulnerability

Student Information System is a web-based application platform by Carlo Montero, a personal developer. It can help a university or college to manage student information and academic records. A SQL injection vulnerability exists in Campcodes Student Information System version 1.0, which stems from...

PT-2023-30695 · Unknown · Xxl-Job-Admin

Name of the Vulnerable Software and Affected Versions: xxl-job-admin version 2.4.0 Description: The issue allows for Remote Code Execution RCE via the /xxl-job-admin/jobcode/save API endpoint. Recommendations: For xxl-job-admin version 2.4.0, as a temporary workaround, consider restricting access...

CVE-2023-38965

Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI...

PT-2023-23482 · Unknown · Sourcecodester Sales Tracker Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Sales Tracker Management System version 1.0 Description: A vulnerability was found in the system, allowing for cross-site scripting through the manipulation of the firstname, middlename, lastname, and username arguments in the...

CVE-2023-31857

Sourcecodester Online Computer and Laptop Store 1.0 allows unrestricted file upload and can lead to remote code execution. The vulnerability path is /classes/Users.php?f=save...

PT-2023-23492 · Unknown · Sourcecodester Online Computer/Laptop Store

Name of the Vulnerable Software and Affected Versions: Sourcecodester Online Computer and Laptop Store version 1.0 Description: The issue allows unrestricted file upload, which can lead to remote code execution. The vulnerability path is "/classes/Users.php?f=save". Recommendations: For version...

PT-2023-11799 · Flycms · Flycms

Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: A Cross Site Request Forgery CSRF issue allows attackers to add arbitrary administrator accounts via the "system/admin/admin save" endpoint. This can be exploited by attackers to gain unauthorized access to the...

PT-2023-2582 · Sourcecodester · Sourcecodester Simple Mobile Comparison Website

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Mobile Comparison Website version 1.0 Description: A vulnerability has been found in the processing of the file classes/Master.php?f=save field, specifically with the Field Name argument, which leads to cross-site...

PT-2023-18948 · Sourcecodester · Sourcecodester Service Provider Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Service Provider Management System version 1.0 Description: A critical issue has been found in the HTTP POST Request Handler component, specifically in the /classes/Master.php?f=save service file. The manipulation of the name...

PT-2023-17102 · Sourcecodester · Sourcecodester Automatic Question Paper Generator System

Name of the Vulnerable Software and Affected Versions: SourceCodester Automatic Question Paper Generator System version 1.0 Description: A problematic issue has been found in the system, affecting the processing of the file classes/Master.php?f=save class. The manipulation of the description...

CVE-2022-30842

Covid-19 Travel Pass Management System v1.0 is vulnerable to Cross Site Scripting XSS via /ctpms/classes/Users.php?f=save, firstname...

CVE-2022-30462

Water-billing-management-system v1.0 is affected by: Cross Site Scripting XSS via /wbms/classes/Users.php?f=save, firstname...

Water-billing-management-system 跨站脚本漏洞

Water-billing-management-system is a water billing management system by Carlo Montero Personal Developer. A security vulnerability exists in Water-billing-management-system version 1.0, which originates from a /wbms/classes/Users.php?f=save, firstname stored cross-site scripting XSS attack...

Simple Social Networking Site 跨站脚本漏洞

Simple Social Networking Site is a social networking site by Carlo Montero Personal Developer. A security vulnerability exists in version 1.0 of Simple Social Networking Site, which originates from a /sns/classes/Users.php?f=save, firstname stored cross-site scripting XSS attack...

CVE-2021-40108

An issue was discovered in Concrete CMS through 8.5.5. The Calendar is vulnerable to CSRF. ccmtoken is not verified on the ccm/calendar/dialogs/event/add/save endpoint...

CVE-2021-40108

An issue was discovered in Concrete CMS through 8.5.5. The Calendar is vulnerable to CSRF. ccmtoken is not verified on the ccm/calendar/dialogs/event/add/save endpoint...

PortlandLabs Concrete Cms 跨站请求伪造漏洞

PortlandLabs Concrete Cms is a team-oriented open source content management system for the United States PortlandLabs . A cross-site request forgery vulnerability exists in PortlandLabs Concrete CMS, which stems from a failure to validate CCM tokens when adding a save endpoint to the product's...

CVE-2021-27254

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is not required to exploit this vulnerability. The specific flaw exists within the applysave.cgi endpoint. This issue results from the use of hard-coded...