Capsule8 Console SQL注入漏洞

Capsule Console is a web interface for Capsule8 from Capsule USA, Inc. It is used for event management, sensor configuration, and system analysis. A SQL injection vulnerability exists in Capsule8 Console 4.6.0 and 4.9.1, which originates from an authenticated and authorized proxy user can gain...

PT-2022-2306 · Cisco · Cisco Small Business Rv260 +8

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV160, RV160W, RV260, RV260P, RV260W, RV340, RV340W, RV345, RV345P affected versions not specified Description: The issue is related to weaknesses in the authentication procedure of the web interface of the affected...

GSD-2022-1000071 Default Credentials in XB6 Fibre+ Gateway version XB6_0821

In Shaw Communications Inc XB6 Fibre+ Gateway version XB60821 a Default Credentials exists in the Router/Modem that can be attacked via local access resulting in Admin access to router...

CAN-2022-1000071 Default Credentials in XB6 Fibre+ Gateway version XB6_0821

In Shaw Communications Inc XB6 Fibre+ Gateway version XB60821 a Default Credentials exists in the Router/Modem that can be attacked via local access resulting in Admin access to router...

CVE-2021-25072

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when deleting items, allowing attacker to make a logged in admin delete arbitrary posts via a CSRF attack...

Ricon Industrial Cellular Router S9922L 操作系统命令注入漏洞

Ricon Mobile Ricon Industrial Cellular Router S9922L and S9922XL are both 4G/4.5G, WiFi and Vpn technology based mobile network routers from Ricon Mobile Canada.Ricon Mobile Ricon Industrial Cellular Router S9922L and S9922XL are vulnerable to OS command injection, which can be exploited by...

CVE-2021-46446

H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=adminaccessgroupedit&aagID...

CVE-2021-46446

H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=adminaccessgroupedit&aagID...

Sql injection

H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=adminaccessgroupedit&aagID...

CVE-2021-46446

H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=adminaccessgroupedit&aagID...

PT-2022-8910 · Liferay · Liferay Portal Server

Name of the Vulnerable Software and Affected Versions: Liferay Portal Server versions 7.2.0 GA1 through 7.3.5 GA6 Description: The issue allows an administrator user to inject commands through the Gogo Shell module, enabling the execution of any OS command on the Liferay Portal Server. This is...

H.H.G. Multistore SQL注入漏洞

H.H.G. Multistore is a software designed to manage multiple stores by the German company H.H.G. Multistore. A security vulnerability exists in H.H.G. Multistore v5.1.0 and below that allows an attacker to perform SQL injection via /admin/admin.php?module=adminaccessgroupedit&aagID...

Online Project Time Management System 1.0 Cross Site Scripting

Exploit Title: Online Project Time Management System 1.0 - Multiple Stored XSS Authenticated Date: 19/01/2022 Exploit Author: Felipe Alcantara Filiplain Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

Online Project Time Management System 1.0 - Multiple Stored Cross Site Scripting Vulnerabilities

Exploit Title: Online Project Time Management System 1.0 - Multiple Stored XSS Authenticated Exploit Author: Felipe Alcantara Filiplain Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

20K WordPress Sites Exposed by Insecure Plugin REST-API

More than 20,000 WordPress sites are vulnerable to malicious code injection, phishing scams and more as the result of a high-severity cross-site scripting XSS bug discovered in the WordPress Email Template Designer – WP HTML Mail, a plugin for designing custom emails. The new vulnerability...

CVE-2021-40694

CVE-2021-40694 affects Moodle-related components and is caused by insufficient escaping of the LaTeX preamble, enabling site administrators to read files accessible to the HTTP server system account. Reported impact per NVD: Confidentiality impact high; other impacts none; attack vector network; ...

PT-2022-13089 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 1.2.11 Description: The issue is related to incorrect permission assignment for critical resources, allowing non-admin users to access sensitive information of other users. This is a case of improper...

CVE-2021-44837

An issue was discovered in Delta RM 1.2. It is possible for an unprivileged user to access the same information as an admin user regarding the risk creation information in the /risque/administration/referentiel/json/create/categorie endpoint, using the idcat1 query parameter to indicate the risk...

SQL Injection

pimcore/pimcore, is vulnerable to SQL injection. The propertiesGetAction function in ClassificationstoreController.php does not properly sanitize the input, which allows a remote attacker to gain admin access to the database...

CVE-2022-23131

CVE-2022-23131 affects the Zabbix Frontend when SAML SSO is enabled (non-default). A malicious, unauthenticated actor can modify session data because user logins stored in the session are not verified, potentially escalating privileges to admin and taking over the frontend. The vulnerability requ...