6437 matches found
CVE-2022-25045
Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel...
CVE-2022-25045
Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel...
Hardcoded credentials
Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel...
CVE-2022-24571
Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...
CVE-2022-24571
Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...
CVE-2022-24571
Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...
Sql injection
Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...
CVE-2022-24571
Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...
CVE-2022-24571
CVE-2022-24571 involves Car Driving School Management System v1.0, where the login page is vulnerable to SQL injection. The root cause is improper input handling on the username parameter, enabling attackers to alter the SQL query and bypass authentication. This can grant admin access and potenti...
Privilege Escalation
dolibarr/dolibarr is vulnerable to privilege escalation. Low privileged attacker is able to update their login name which should only be updated by admin allowing the attacker to gain access to sensitive information and elevate privileges...
CVE-2021-25010
The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Scripting issues...
CVE-2021-25010
The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Scripting issues...
Cross site request forgery (csrf)
In the Orange Form WordPress plugin through 1.0, the processbulkaction function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter $id. Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually...
CVE-2022-24620
Piwigo version 12.2.0 is vulnerable to stored cross-site scripting XSS, which can lead to privilege escalation. In this way, admin can steal webmaster's cookies to get the webmaster's access...
Vulnerabilities fixed in Trend Micro Server Protect
Trend Micro has fixed multiple vulnerabilities in Server Protect. The vulnerability with reference CVE-2022-25329 allows a remote malicious person to misuse a hardcoded password in order to perform administrative actions. perform. The other vulnerabilities allow an authenticated malicious person...
UPchieve: All user password hash can be seen from admin panel
Summary: During my primary research I found that api/users?page=1&userId=&firstName=test&lastName=&email=&partnerOrg=&highSchool= this endpoint gives hashed password of all users. Steps To Reproduce: + Login to Admin and go to Admin-- Search Users. + We see a request like this was send and in...
CVE-2022-23650
Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and...
CVE-2020-8242
Unsanitized user input in ExpressionEngine = 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/admin control panel access to execute the attack...
Sql injection
Unsanitized user input in ExpressionEngine = 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/admin control panel access to execute the attack...