6803 matches found
Author Bio Box < 3.4.0 - Admin+ Stored Cross-Site Scripting
The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the /includes/admin/class-author-bio-box-admin.php file which allowed attackers with administrative user access to inject arbitrary web scripts. This affec...
WordPress 插件跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...
Simple Online College Entrance Exam System 1.0 - (Multiple) SQL injection Vulnerability
Exploit Title: Simple Online College Entrance Exam System 1.0 - 'Multiple' SQL injection Exploit Author: Amine ismail @aminei Vendor Homepage: https://www.sourcecodester.com/php/14976/simple-online-college-entrance-exam-system-php-and-sqlite-free-source-code.html Software Link:...
CVE-2021-42086
An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request...
Cross site request forgery (csrf)
An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request...
CVE-2021-42087
An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API...
CVE-2021-42086
An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request...
CVE-2021-42086
CVE-2021-42086 affects Zammad prior to 4.1.1. An Agent account can modify other account data via a crafted request and gain administrator privileges, leading to elevation of privilege. The vulnerability is described across multiple sources (NVD entry and CNVD/CNNVD/CVE records) as an account‑leve...
G Auto-Hyperlink <= 1.0.1 - Admin+ SQL Injection
The plugin does not sanitise or escape an 'id' GET parameter before using it in a SQL statement, to select data to be displayed in the admin dashboard, leading to an authenticated SQL injection https://plugins.trac.wordpress.org/browser/g-auto-hyperlink/trunk/g-auto-hyperlink.phpL271 Open the...
IBM Ts7700 授权问题漏洞
The Ibm Ts7700 is a mainframe virtual tape solution from Ibm, Inc. for optimizing data security and business continuity. An authorization issue vulnerability exists in the IBM TS7700 Management Interface, which can be exploited by an attacker to gain administrative access to the Management...
CVE-2021-36286
Dell SupportAssist Client Consumer versions 3.9.13.0 and any versions prior to 3.9.13.0 contain an arbitrary file deletion vulnerability that can be exploited by using the Windows feature of NTFS called Symbolic links. Symbolic links can be created by anynon-privileged user under some object...
Arbitrary file deletion
Dell SupportAssist Client Consumer versions 3.9.13.0 and any versions prior to 3.9.13.0 contain an arbitrary file deletion vulnerability that can be exploited by using the Windows feature of NTFS called Symbolic links. Symbolic links can be created by anynon-privileged user under some object...
TIBCO Security Advisory: October 5, 2021 - TIBCO FTL -2021-35497
TIBCO FTL unvalidated SAN in client certificates Original release date: October 5, 2021 Last revised:March 10, 2022 CVE-2021-35497 Source: TIBCO SoftwareInc. Products Affected TIBCO ActiveSpaces - Community Edition versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2 TIBCO ActiveSpaces - Develop...
South Gate Inn Online Reservation System 1.0 Shell Upload / SQL Injection Vulnerabilities
Exploit Title: South Gate Inn Online Reservation System v1.0 - Remote Code Execution Exploit Author: Janik Wehrli Vendor Homepage: https://www.sourcecodester.com/php/10584/south-gate-inn-online-reservation-system.html Software Link:...
South Gate Inn Online Reservation System 1.0 Shell Upload / SQL Injection
Exploit Title: South Gate Inn Online Reservation System v1.0 - Remote Code Execution Date: 21.09.2021 Exploit Author: Janik Wehrli Vendor Homepage: https://www.sourcecodester.com/php/10584/south-gate-inn-online-reservation-system.html Software Link:...
CVE-2021-24663
The Simple Schools Staff Directory WordPress plugin through 1.1 does not validate uploaded logo pictures to ensure that are indeed images, allowing high privilege users such as admin to upload arbitrary file like PHP, leading to RCE...
CVE-2021-41383
setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntpserver field...
CVE-2021-37201
A vulnerability has been identified in SINEC NMS All versions V1.0 SP1. The web interface of affected devices is vulnerable to a Cross-Site Request Forgery CSRF attack. This could allow an attacker to manipulate the SINEC NMS configuration by tricking an unsuspecting user with administrative...
CVE-2021-24431
The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This could allow attackers to make a logged in admin change the settings, and set Cross-Site Scripting...
