PT-2022-8592

Name of the Vulnerable Software and Affected Versions Intelliants Subrion CMS version 4.2.1 Description A Cross Site Request Forgery CSRF issue exists via the Members administrator function, allowing a remote unauthenticated malicious user to send an authorized request to a victim and successfull...

CVE-2022-24573

A stored cross-site scripting XSS vulnerability in the admin interface in Element-IT HTTP Commander 7.0.0 allows unauthenticated users to get admin access by injecting a malicious script in the User-Agent field...

CVE-2022-24573

A stored cross-site scripting XSS vulnerability in the admin interface in Element-IT HTTP Commander 7.0.0 allows unauthenticated users to get admin access by injecting a malicious script in the User-Agent field...

CVE-2022-25045

Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel...

CVE-2022-25045

Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel...

Hardcoded credentials

Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel...

PT-2022-16568

Name of the Vulnerable Software and Affected Versions Extensis Portfolio version 4.0 Description The issue concerns hardcoded credentials in the software, which can be exploited by attackers to gain administrator privileges. Recommendations For Extensis Portfolio version 4.0, consider changing th...

CVE-2022-24571

Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...

CVE-2022-24571

Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...

CVE-2022-24571

Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...

Sql injection

Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...

CVE-2022-24571

Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...

CVE-2022-24571

CVE-2022-24571 involves Car Driving School Management System v1.0, where the login page is vulnerable to SQL injection. The root cause is improper input handling on the username parameter, enabling attackers to alter the SQL query and bypass authentication. This can grant admin access and potenti...

Privilege Escalation

dolibarr/dolibarr is vulnerable to privilege escalation. Low privileged attacker is able to update their login name which should only be updated by admin allowing the attacker to gain access to sensitive information and elevate privileges...

CVE-2021-25010

The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Scripting issues...

CVE-2021-25010

The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Scripting issues...

Cross site request forgery (csrf)

In the Orange Form WordPress plugin through 1.0, the processbulkaction function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter $id. Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually...

CVE-2022-24620

Piwigo version 12.2.0 is vulnerable to stored cross-site scripting XSS, which can lead to privilege escalation. In this way, admin can steal webmaster's cookies to get the webmaster's access...

Vulnerabilities fixed in Trend Micro Server Protect

Trend Micro has fixed multiple vulnerabilities in Server Protect. The vulnerability with reference CVE-2022-25329 allows a remote malicious person to misuse a hardcoded password in order to perform administrative actions. perform. The other vulnerabilities allow an authenticated malicious person...

UPchieve: All user password hash can be seen from admin panel

Summary: During my primary research I found that api/users?page=1&userId=&firstName=test&lastName=&email=&partnerOrg=&highSchool= this endpoint gives hashed password of all users. Steps To Reproduce: + Login to Admin and go to Admin-- Search Users. + We see a request like this was send and in...