450 matches found
PT-2024-21308 · Fujian Kelixin · Fujian Kelixin Communication Command/Dispatch Platform
Name of the Vulnerable Software and Affected Versions: Fujian Kelixin Communication Command and Dispatch Platform versions up to 20240318 Description: A critical issue affects some unknown functionality of the file api/client/user/pwd update.php. The manipulation of the uuid argument leads to SQL...
PT-2024-19497 · Flycms · Flycms
Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. It can be exploited via the /system/user/group update API endpoint. Recommendations: For FlyCms version 1.0, as a temporary workaround, consider...
PT-2024-12222 · Unknown · Oretnom23 Judging Management System
Name of the Vulnerable Software and Affected Versions: oretnom23 Judging Management System version 1.0 Description: The issue allows remote attackers to execute arbitrary code and obtain sensitive information via the sub event id parameter in the "sub event stat update.php" endpoint...
PT-2023-31948 · Idurar · Idurar
Name of the Vulnerable Software and Affected Versions: IDURAR aka idurar-erp-crm versions 2.0.1 and earlier Description: The issue allows stored XSS via a PATCH request with a crafted JSON email template in the "/api/email/update" data. This can be exploited by sending a specially crafted request...
PT-2023-32917 · Unknown · Novel-Plus
Name of the Vulnerable Software and Affected Versions: Novel-Plus versions up to 4.2.0 Description: A problematic vulnerability has been found in Novel-Plus, affecting an unknown part of the file /user/updateUserInfo of the component HTTP POST Request Handler. The manipulation of the nickName...
GHSA-8HCH-Q86G-J38W Cross-Site Request Forgery in JFinalCMS via /admin/category/update
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/category/update...
CVE-2023-49395
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/category/update...
PT-2023-29758 · Unknown · Dreamer Cms
Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: A Cross-Site Request Forgery CSRF issue was discovered in Dreamer CMS via the component "/variable/update". This allows for unauthorized actions to be performed on behalf of a user. Recommendations: For...
Companymaps v8.0 - Stored Cross Site Scripting Vulnerability
Exploit Title: Companymaps V8.0 - Stored Cross Site Scripting XSS Exploit Author: Lucas Noki 0xPrototype Vendor Homepage: https://github.com/vogtmh Software Link: https://github.com/vogtmh/cmaps Version: 8.0 Tested on: Mac, Windows, Linux CVE : CVE-2023-29983 Steps to reproduce: 1. Clone the...
CVE-2023-26120
This affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/user/add and /xxl-job-admin/user/update...
PT-2023-20058 · Unknown · Online Reviewer Management System
Name of the Vulnerable Software and Affected Versions: Online Reviewer Management System version 1.0 Description: An issue was discovered in the Online Reviewer Management System, where a SQL injection can directly issue instructions to the background database system via the "reviewer...
Online Tours & Travels Management System SQL注入漏洞
Online Tours & Travels Management System is an online travel management system developed by Mayuri K. A SQL injection vulnerability exists in Online Tours & Travels Management System v1.0, which originates from /admin/update The booking.php id parameter lacks validation for external input SQL...
PT-2022-20880 · Harbor · Harbor
Name of the Vulnerable Software and Affected Versions: Harbor versions prior to 2.5.2 Description: The issue arises from the failure to validate user permissions when updating a robot account that belongs to a project the authenticated user doesn’t have access to. By sending a request to update a...
PT-2022-22818 · Unknown · Web Based Quiz System
Name of the Vulnerable Software and Affected Versions: Web Based Quiz System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the qid parameter at the "update.php" endpoint. Recommendations: For Web Based Quiz System version...
CVE-2022-30838
Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/classes/Master.php?f=updateapplicationstatus...
CVE-2022-28911
TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/CloudACMunualUpdate...
PT-2022-19306 · Totolink · Totolink N600R
Name of the Vulnerable Software and Affected Versions: TOTOLink N600R version 5.3c.7159 B20190425 Description: A command injection issue was found via the filename parameter in the "/setting/CloudACMunualUpdate" API endpoint. Recommendations: For TOTOLink N600R version 5.3c.7159 B20190425, avoid...
PT-2022-17708 · Qdpm · Qdpm
Name of the Vulnerable Software and Affected Versions: qdPM version 9.2 Description: The issue allows Cross-Site Request Forgery CSRF via the "index.php/myAccount/update" URI. This means an attacker can trick a user into performing unintended actions on the web application. Recommendations: For...