Authentication Bypass Using an Alternate Path or Channel

Overview signalk-server is an An implementation of a Signal K server for boats. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the /skServer/enableSecurity endpoint. An attacker can gain unauthorized administrative privileges by...

CVE-2025-62729

SOPlanning is vulnerable to Stored XSS in /status endpoint. Malicious attacker with an account can inject arbitrary HTML and JS into website, which will be rendered/executed when opening multiple pages. This issue was fixed in version 1.55...

CVE-2019-10263

An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When creating a trial account, it is possible to inject XSS in the Alias field, allowing the attacker to retrieve the admin's cookie and take over the account...

PHP ACRSS 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : php acrss 1.0 CSRF Add Admin Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 130.0.0 64 bits | ...

CVE-2019-25141

The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admininit function, in addition to insufficient input validation. This makes it possible for unauthenticated attackers to modify the...

Southern data, a good precision system, Web soft world exploits-vulnerability warning-the black bar safety net

1, through the upfileother. asp vulnerability file taken directly SHELL Directly open userreg. asp for registered members, log in not logged state, use local Upload File Upload code is as follows: HTMLHEAD META http-equiv=Content-Type content="text/html; charset=gb2312" STYLE type=text/cssBODY...

pnews.txt

Admin Access Vulnerability in P-News 1.6 Url: http://www.ppopn.net It is possible to gain admin access if you possess a 'Member' account due to a flaw in the 'p-news.php' file. You can inject an entire arbitrary account, including all the fields, into the 'Name' field, which will push all the...