PT-2021-6286 · Adobe · Magento Commerce

Name of the Vulnerable Software and Affected Versions: Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier Magento Commerce version 2.3.7 and earlier Description: The issue is related to improper authorization in Magento Commerce, allowing an attacker with admin privileges to...

MTN Group: Default Login Credentials on https://broadbandmaps.mtn.com.gh/

Summary: Hello Team, I just found out that broadbandmaps.mtn.com.gh requires logging in when you visit it, but it turned out that you can actually login as an Admin and do anything on the specific site. when you visit the mentioned site you will get this F1405776 it will require to be logged in t...

CVE-2021-24522

The User Registration, User Profile, Login & Membership – ProfilePress Formerly WP User Avatar WordPress plugin before 3.1.11's widget for tabbed login/register was not properly escaped and could be used in an XSS attack which could lead to wp-admin access. Further, the plugin in several places...

CVE-2021-24522

CVE-2021-24522 affects ProfilePress (formerly WP User Avatar) for WordPress, before version 3.1.11. The tabbed login/register widget is vulnerable to unauthenticated reflected XSS due to improper escaping, with some cases enabling replication via $_GET because $_POST values were mapped to $_GET. ...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin ProfilePress, which stems from t...

A vulnerability in the web interface for managing Microprogramming Software on Cisco Small Business 220 Series Smart routers exists. This vulnerability is related to an incorrect session duration, which allows a perpetrator to bypass authentication procedures, gain unauthorized access to the device’s web interface, and perform arbitrary actions with administrator privileges.

The vulnerability of the web interface for managing Microprogramming Software on Cisco Small Business 220 Series Smart routers is related to an incorrect session duration. Exploiting this vulnerability could allow a malicious actor to bypass authentication procedures, gain unauthorized access to...

CVE-2021-24480

The Event Geek WordPress plugin through 2.5.2 does not sanitise or escape its "Use your own " setting before outputting it in the page, leading to an authenticated admin+ stored Cross-Site Scripting issue...

CVE-2021-24443

The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the...

CVE-2021-24480

The Event Geek WordPress plugin through 2.5.2 does not sanitise or escape its "Use your own " setting before outputting it in the page, leading to an authenticated admin+ stored Cross-Site Scripting issue...

CVE-2021-24443

The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the...

Sourcecodester Basic Shopping Cart SQL Injection Vulnerability

SourceCodester Basic Shopping Cart is a Web application from SourceCodester USA. The program allows visitors to your online shopping site to collect items in a virtual shopping cart through multiple product pages without losing ordered items. A SQL injection vulnerability exists in SourceCodester...

CVE-2021-34166

A SQL INJECTION vulnerability in Sourcecodester Simple Food Website 1.0 allows a remote attacker to Bypass Authentication and become Admin...

CVE-2021-34165

A SQL Injection vulnerability in Sourcecodester Basic Shopping Cart 1.0 allows a remote attacker to Bypass Authentication and become Admin...

CVE-2021-34166

A SQL INJECTION vulnerability in Sourcecodester Simple Food Website 1.0 allows a remote attacker to Bypass Authentication and become Admin...

SourceCodester Simple Food Website SQL注入漏洞

SourceCodester Simple Food Website is a CMS by SourceCodester, Inc. developed using PHP and MySQL database. sourcecodester Basic Shopping Cart is vulnerable to SQL injection, which can be exploited by attackers to bypass authentication Become an administrator...

CVE-2021-25273

Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706...

CVE-2020-5353

The Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for Network File System NFS allows access to an 'admin' home directory. An attacker may leverage a spoofed Unique Identifier UID over NFS to rewrite sensitive files to gain...

Shopify: Stored XSS in SVG file as data: url

A stored XSS vulnerability was discovered in Shopify's rich text editor on July 24, 2021. Attackers were able to insert an XSS payload encoded in an SVG file using data: URLs. The vulnerability was fixed by preventing the conversion of data: URLs into blob: URLs...

CVE-2021-32775

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field values through GroupBy Dashlet error message. This issue is fixed in versions 2.7.4 and 3.0.0...

CVE-2021-22730

A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could an attacker to gain...