CVE-2024-13067 CodeAstro Online Food Ordering System All Users Page all_users.php access control

A vulnerability was found in CodeAstro Online Food Ordering System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/allusers.php of the component All Users Page. The manipulation leads to improper access controls. The attack may be initiated remotely...

PT-2024-17912 · Unknown · Codeastro Online Food Ordering System

Name of the Vulnerable Software and Affected Versions: CodeAstro Online Food Ordering System version 1.0 Description: A critical issue affects some unknown processing of the file /admin/all users.php of the component All Users Page, leading to improper access controls. The attack may be initiated...

User Management System /ums-sp/admin/registered-users.php File Cross-Site Scripting Vulnerability

User Management System is a user management system. User Management System suffers from a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied data in the file /ums-sp/admin/registered-users.php, which can be exploited by an attacke...

CVE-2024-50991

A Cross Site Scripting XSS vulnerability was found in /ums-sp/admin/registered-users.php in PHPGurukul User Management System v1.0, which allows remote attackers to execute arbitrary code via the "fname" POST request parameter...

Music Gallery Site SQL注入漏洞

Music Gallery Site is a music gallery site by Carlo Montero's personal developer. A SQL injection vulnerability exists in Music Gallery Site version 1.0, which originates from an SQL injection vulnerability in the id parameter of the /classes/Users.php?f=delete page...

SourceCodester Clinics Patient Management System 跨站请求伪造漏洞

SourceCodester Clinics Patient Management System is a clinic patient management system from SourceCodester, Inc. A cross-site request forgery vulnerability exists in SourceCodester Clinics Patient Management System version 1.0, which stems from a cross-site request forgery vulnerability in the Us...

CVE-2024-1852

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and including, 3.4.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2024-1852 WP-Members Membership Plugin <= 3.4.9.2 - Unauthenticated Stored Cross-Site Scripting

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and including, 3.4.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

PT-2024-18363 · WordPress · Wp-Members Membership Plugin

Name of the Vulnerable Software and Affected Versions: WP-Members Membership Plugin versions prior to 3.4.9.3 Description: The WP-Members Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header due to insufficient input sanitization and output...

Insurance Management System PHP And MySQL 1.0 Cross Site Scripting

Exploit Title:Insurance Management System PHP and MySQL 1.0 - Multiple Stored XSS Date: 2024-02-08 Exploit Author: Hakkı TOKLU Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/16995/insurance-management-system-php-mysql.html Version: 1.0 Tested on:...

CVE-2024-2532

A vulnerability classified as critical was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/update-users.php. The manipulation of the argument id leads to sql injection. The attack can be launched...

PT-2024-38477 · Sourcecodester · Sourcecodester Clinics Patient Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Clinics Patient Management System version 1.0 Description: A vulnerability was found in the User Page component, specifically in the file users.php, which can lead to cross-site request forgery. The attack can be initiated...

Weseek GROWI Security Vulnerability

Weseek GROWI is a team collaboration software from Weseek Japan. A security vulnerability exists in Weseek GROWI versions prior to 6.1.11, which stems from a stored cross-site scripting XSS vulnerability in the User Management /admin/users page...

CVE-2023-6312

A vulnerability was found in SourceCodester Loan Management System 1.0. It has been classified as critical. Affected is the function deleteuser of the file deleteUser.php of the component Users Page. The manipulation of the argument userid leads to sql injection. It is possible to launch the atta...

Sql injection

A vulnerability was found in SourceCodester Loan Management System 1.0. It has been classified as critical. Affected is the function deleteuser of the file deleteUser.php of the component Users Page. The manipulation of the argument userid leads to sql injection. It is possible to launch the atta...

CVE-2023-6312 SourceCodester Loan Management System Users Page deleteUser.php delete_user sql injection

A vulnerability was found in SourceCodester Loan Management System 1.0. It has been classified as critical. Affected is the function deleteuser of the file deleteUser.php of the component Users Page. The manipulation of the argument userid leads to sql injection. It is possible to launch the atta...

Online Food Ordering System SQL Injection Vulnerability

Online Food Ordering System is an online food ordering system by Carlo Montero, a personal developer. A SQL injection vulnerability exists in Online Food Ordering System v1.0, which is caused by insufficient filtering of the address parameter on the routers/add-users.php page...

CVE-2023-3847

A vulnerability classified as problematic was found in mooSocial mooDating 1.2. This vulnerability affects unknown code of the file /users of the component URL Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. VDB-235198 is the identifier assigned to...

CVE-2022-46472

Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /hss/classes/Users.php?f=delete...

Stored XSS in admin panel (users page)

Description Stored XSS in admin panel in users page via inject XSS payload in Name input field by any user to affect the admin panel Proof of Concept https://drive.google.com/file/d/1EsYq3R6GRAdEbpZxp2RwQwGr4G8fJGB7/view?usp=sharing...