14939 matches found
CVE-2023-41923
The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords...
CVE-2023-32568
An issue was discovered in Veritas InfoScale Operations Manager VIOM before 7.4.2.800 and 8.x before 8.0.410. The VIOM web application does not validate user-supplied data and appends it to OS commands and internal binaries used by the application. An attacker with root/administrator level...
CVE-2023-3034
Reflected XSS affects the ‘mode’ parameter in the /admin functionality of the web application in versions =2.0.44...
CVE-2023-24070
app/View/AuthKeys/authkeydisplay.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field...
CVE-2023-1848
A vulnerability was found in SourceCodester Online Payroll System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/attendancerow.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit ha...
CVE-2023-45596
A CWE-425 “Direct Request 'Forced Browsing'” vulnerability in the “fileconfiguration” functionality of the web application allows a remote unauthenticated attacker to access confidential configuration files. This issue affects: AiLux imx6 bundle below version imx61.0.7-2...
CVE-2023-3032
Unrestricted Upload of File with Dangerous Type vulnerability in Mobatime web application Documentary proof upload modules allows a malicious user to Upload a Web Shell to a Web Server.This issue affects Mobatime web application: through 06.7.22...
CVE-2023-6689
A successful CSRF attack could force the user to perform state changing requests on the application. If the victim is an administrative account, a CSRF attack could compromise the entire web application...
CVE-2023-6964
The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.26 via the 'kadenceimportgetnewconnectiondata' AJAX action. This makes it possible for authenticated attackers, with...
CVE-2022-25343
An issue was discovered on Olivetti d-COLOR MF3555 2XDS000.002.271 devices. The Web Application is affected by Denial of Service. An unauthenticated attacker, who can send POST requests to the /download/set.cgi page by manipulating the failhtmfile variable, is able to cause interruption of the...
CVE-2022-4539
The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the...
CVE-2022-47595
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WP Go Maps formerly WP Google Maps plugin = 9.0.15 versions...
CVE-2022-40178
A vulnerability has been identified in Desigo PXM30-1 All versions V02.20.126.11-41, Desigo PXM30.E All versions V02.20.126.11-41, Desigo PXM40-1 All versions V02.20.126.11-41, Desigo PXM40.E All versions V02.20.126.11-41, Desigo PXM50-1 All versions V02.20.126.11-41, Desigo PXM50.E All versions...
CVE-2022-40402
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/clientassign.php...
CVE-2022-45010
Simple Phone Book/Directory Web App v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at /PhoneBook/edit.php...
CVE-2022-44786
An issue was discovered in Appalti & Contratti 9.12.2. The target web applications allow Local File Inclusion in any page relying on the href parameter to specify the JSP page to be rendered. This affects ApriPagina.do POST and GET requests to each application...
CVE-2022-24219
eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/editpage.php...
CVE-2022-40934
Online Pet Shop We App v1.0 is vulnerable to SQL injection via /petshop/classes/Master.php?f=deletesubcategory,id...
CVE-2022-40693
A cleartext transmission vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted network sniffing can lead to a disclosure of sensitive information. An attacker can sniff network traffic to trigger this vulnerability...