CVE-2023-49809 Todo plugin gets crashed and disabled by member

Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to that endpoint and make it crash. After a few repetitions, the plugin is disabled...

PT-2023-31365 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue arises from Mattermost's failure to handle a null request body in the "/add" endpoint. This allows a simple member to send a request with a null request body to the endpoint,...

CVE-2020-12615

An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. When adding the Add Admin token to a process, and specifying that it runs at medium integrity with the user owning the process, this security token can be stolen and applied to arbitrary processes...

Mattermost 资源管理错误漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a denial-of-service vulnerability that stems from an inability to handle empty request bodies in an add endpoint, which could be exploited by an attacker to send a request with ...

PT-2023-11470 · Beyondtrust · Beyondtrust Privilege Management For Windows

Name of the Vulnerable Software and Affected Versions: BeyondTrust Privilege Management for Windows versions through 5.6 Description: An issue was discovered where the publisher criteria can be leveraged by a malicious actor to achieve Elevation of Privileges from standard user to administrator...

PT-2023-11471 · Beyondtrust · Beyondtrust Privilege Management For Windows

Name of the Vulnerable Software and Affected Versions: BeyondTrust Privilege Management for Windows versions through 5.6 Description: An issue was discovered in BeyondTrust Privilege Management for Windows. When adding the Add Admin token to a process and specifying that it runs at medium integri...

Prototype Pollution

Overview node-gettext is an A JavaScript implementation of gettext, a localization framework Affected versions of this package are vulnerable to Prototype Pollution via the addTranslations function in gettext.js due to improper user input sanitization. PoC js const Gettext = require'node-gettext'...

mariadb: use-after-poison in prepare_inplace_add_virtual in handler0alter.cc

MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepareinplaceaddvirtual at /storage/innobase/handler/handler0alter.cc...

Dreamer CMS Cross-Site Request Forgery Vulnerability (CNVD-2023-9571566)

Dreamer CMS is a dreamer content management system by Junnan Wang, an individual developer in China. A cross-site request forgery vulnerability exists in Dreamer CMS version v4.1.3, which originates from a failure to adequately validate whether a request is from a trusted user in the component...

WBCE CMS 1.6.1 Shell Upload Vulnerability

Exploit Title: WBCE CMS Version : 1.6.1 Remote Command Execution Exploit Author: tmrswrr Vendor Homepage: https://wbce-cms.org/ Software Link: https://github.com/WBCE/WBCECMS/archive/refs/tags/1.6.1.zip Version: 1.6.1 Tested on: https://www.softaculous.com/apps/cms/WBCECMS POC: 1 Login with admin...

CVE-2023-6464

A vulnerability was found in SourceCodester User Registration and Login System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /endpoint/add-user.php. The manipulation of the argument user leads to sql injection. The attack may be launched remotely...

SourceCodester User Registration and Login System SQL Injection Vulnerability

User Registration and Login System is a user registration and login system by Remy Andrade, an individual developer. A SQL injection vulnerability exists in the SourceCodester User Registration and Login System, which originates from an SQL injection in the user parameter of /endpoint/add-user.ph...

CVE-2023-6463

A vulnerability has been found in SourceCodester User Registration and Login System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /endpoint/add-user.php. The manipulation of the argument firstname leads to cross site scripting. The attac...

CVE-2023-6463 SourceCodester User Registration and Login System add-user.php cross site scripting

A vulnerability has been found in SourceCodester User Registration and Login System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /endpoint/add-user.php. The manipulation of the argument firstname leads to cross site scripting. The attac...

PT-2023-32676 · Unknown · Sourcecodester User Registration/Login System

Name of the Vulnerable Software and Affected Versions: SourceCodester User Registration and Login System version 1.0 Description: A vulnerability has been found in the system, classified as problematic. It affects an unknown functionality of the file "/endpoint/add-user.php". The manipulation of...

SourceCodester User Registration and Login System Cross-Site Scripting Vulnerability

User Registration and Login System is a user registration and login system by Remy Andrade, an individual developer. A cross-site scripting vulnerability exists in the SourceCodester User Registration and Login System, which originates from cross-site scripting in the firstname parameter of...

CVE-2023-6442

A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file add-phlebotomist.php. The manipulation of the argument empid/fullname leads to cross site scripting. The...

CVE-2023-6440

A vulnerability was found in SourceCodester Book Borrower System 1.0 and classified as problematic. This issue affects some unknown processing of the file endpoint/add-book.php. The manipulation of the argument Book Title/Book Author leads to cross site scripting. The attack may be initiated...

Cross site scripting

A vulnerability was found in SourceCodester Book Borrower System 1.0 and classified as problematic. This issue affects some unknown processing of the file endpoint/add-book.php. The manipulation of the argument Book Title/Book Author leads to cross site scripting. The attack may be initiated...

CVE-2023-6440 SourceCodester Book Borrower System add-book.php cross site scripting

A vulnerability was found in SourceCodester Book Borrower System 1.0 and classified as problematic. This issue affects some unknown processing of the file endpoint/add-book.php. The manipulation of the argument Book Title/Book Author leads to cross site scripting. The attack may be initiated...