PT-2022-27845 · Rackn · Rackn Digital Rebar

Name of the Vulnerable Software and Affected Versions: RackN Digital Rebar versions 4.6.14 and earlier RackN Digital Rebar versions 4.7 through 4.7.22 RackN Digital Rebar versions 4.8 through 4.8.5 RackN Digital Rebar versions 4.9 through 4.9.12 RackN Digital Rebar versions 4.10 through 4.10.8...

CVE-2022-46382

RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has Insecure Permissions. After signing into Digital Rebar, users are issued authentication tokens tied to their account to perform actions within Digital Rebar. During the...

CVE-2022-43326

An Insecure Direct Object Reference IDOR vulnerability in the password reset function of Telos Alliance Omnia MPX Node 1.0.0-1.4. allows attackers to arbitrarily change user and Administrator account passwords...

Host Header Injection

microweber/microweber is vulnerable to host header injection.The vulnerability exist because an attacker is able to reset the password and take over a user account via password reset poisoning through a host header injection attack...

GHSA-F3HW-3H74-WR98 Cross-site Scripting in librenms/librenms

A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary...

CVE-2022-4068

A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary...

Design/Logic Flaw

A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary...

Medium: Users receive an incorrect account of their accumulated ETH in GiantMevAndFeesPool.

Lines of code Vulnerability details Description GiantMEVAndFeesPool exposes previewAccumulatedETH for users to view how much ETH they have accumulated through the vault: function previewAccumulatedETH address user, address calldata stakingFundsVaults, LPToken calldata lpTokens external view retur...

Revenue Collection System 1.0 Cross Site Scripting / Authentication Bypass Exploit

Exploit Title: Revenue Collection System v1.0 - Authentication Bypass via Stored XSS Exploit Author: Joe Pollock Vendor Homepage: https://www.sourcecodester.com/php/14904/rates-system.html Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/rates.zip Tested on: Ka...

Revenue Collection System 1.0 Cross Site Scripting / Authentication Bypass

Exploit Title: Revenue Collection System v1.0 - Authentication Bypass via Stored XSS Exploit Author: Joe Pollock Date: November 16, 2022 Vendor Homepage: https://www.sourcecodester.com/php/14904/rates-system.html Software Link:...

Directorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR

The plugin suffers from an IDOR vulnerability which an attacker can exploit to change the password of arbitrary users instead of his own. PoC The following Python script automates the exploitation of this vulnerability. The script was tested on an installation of WordPress 6.1 with the vulnerable...

CVE-2022-40843

Affected product: Tenda AC1200 V-W15Ev2 (W15Ev2, firmware version V15.11.0.10(1576)). Vulnerability: Improper authorization/improper session management allows bypassing the router login page. This can lead to reading the router’s syslog.log file which contains the MD5 password of the Administrato...

CVE-2022-3949

A vulnerability, which was classified as problematic, has been found in Sourcecodester Simple Cashiering System. This issue affects some unknown processing of the component User Account Handler. The manipulation of the argument fullname leads to cross site scripting. The attack may be initiated...

CVE-2022-3949

A vulnerability, which was classified as problematic, has been found in Sourcecodester Simple Cashiering System. This issue affects some unknown processing of the component User Account Handler. The manipulation of the argument fullname leads to cross site scripting. The attack may be initiated...

Cross site scripting

A vulnerability, which was classified as problematic, has been found in Sourcecodester Simple Cashiering System. This issue affects some unknown processing of the component User Account Handler. The manipulation of the argument fullname leads to cross site scripting. The attack may be initiated...

CVE-2022-3949 Sourcecodester Simple Cashiering System User Account cross site scripting

A vulnerability, which was classified as problematic, has been found in Sourcecodester Simple Cashiering System. This issue affects some unknown processing of the component User Account Handler. The manipulation of the argument fullname leads to cross site scripting. The attack may be initiated...

Simple Cashiering System 跨站脚本漏洞

Simple Cashiering System is a simple open source cashiering system by Carlo Montero personal developer. It is used to help businesses manage their daily transactions. A security vulnerability exists in Simple Cashiering System, which stems from some unknown handling of the user account handler, a...

PT-2022-24974 · Unknown · Sourcecodester Simple Cashiering System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Simple Cashiering System affected versions not specified Description: A problematic issue has been found in the User Account Handler component, where the manipulation of the fullname argument leads to cross-site scripting. The...

CVE-2022-3949

CVE-2022-3949 affects Sourcecodester Simple Cashiering System, specifically the User Account Handler where manipulating the fullname parameter triggers cross-site scripting (XSS). Reported to permit remote initiation, with no documented exploit details in the provided sources. The impact is descr...

CVE-2022-3949 Sourcecodester Simple Cashiering System User Account cross site scripting

A vulnerability, which was classified as problematic, has been found in Sourcecodester Simple Cashiering System. This issue affects some unknown processing of the component User Account Handler. The manipulation of the argument fullname leads to cross site scripting. The attack may be initiated...