Cross site scripting

FUDForum 3.1.2 is vulnerable to Cross Site Scripting XSS via pagetitle param in Page Manager in the Admin Control Panel...

CVE-2022-30863

FUDForum 3.1.2 is vulnerable to Cross Site Scripting XSS via pagetitle param in Page Manager in the Admin Control Panel...

CVE-2022-30863

CVE-2022-30863 affects FUDForum 3.1.2 and is documented as a Cross-Site Scripting (XSS) vulnerability via the page_title parameter in the Page Manager of the Admin Control Panel. The provided connected sources consistently describe the issue but do not specify technical details beyond the vulnera...

CVE-2022-30863

FUDForum 3.1.2 is vulnerable to Cross Site Scripting XSS via pagetitle param in Page Manager in the Admin Control Panel...

CVE-2022-30860

FUDforum 3.1.2 is vulnerable to remote code execution via the Upload File feature of the File Administration System in the Admin Control Panel. Connected advisories and vendor pages consistently describe an arbitrary file upload vulnerability that could allow code execution on affected systems. S...

CVE-2022-30860

FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel...

CVE-2022-30863: Improper Neutralization of Input During Web Page Generation

FUDForum 3.1.2 is vulnerable to Cross Site Scripting XSS via pagetitle param in Page Manager in the Admin Control Panel...

CVE-2022-30860: Unrestricted Upload of File with Dangerous Type

FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel...

Metasploit Weekly Wrap-Up

Ask and you may receive Module suggestions for the win, this week we see a new module written by jheysel-r7 based on CVE-2022-26352 that happens to have been suggested by jvoisin in the issue queue last month. This module targets an arbitrary file upload in dotCMS versions before 22.03, 5.3.8.10,...

The vulnerability of the Admin CP configuration module of the MyBB forum creation software allows a hacker to execute arbitrary code.

The vulnerability of the Admin CP module for the MyBB forum creation software is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Fee can possibly be set maliciously

Lines of code Vulnerability details Fee is set by an admin and can be set maliciously to steal the funds that are entitled to go to the user. Impact Fee can be set to a maliciously high value to unfairly extract funds from protocol users. An owner can buy options, set fee to 100% and exercise...

GHSA-H3MR-Q96R-37V4 phpBB Remote Code Execution

Passing an absolute path to a fileexists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions...

phpBB Remote Code Execution

Passing an absolute path to a fileexists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions...

CVE-2022-23904: Cross-Site Request Forgery (CSRF)

Rainworx Auctionworx 3.1R2 is vulnerable to a Cross-Site Request Forgery CSRF attack that allows an authenticated user to upgrade his account to admin and gain access to the auctionworx admin control panel. This vulnerability affects AuctionWorx Enterprise and AuctionWorx: Events Edition...

Reward lost

Judge @GalloDaSballo has assessed the 11th item in QA Report 26 as Medium risk. The relevant finding follows: … Contract: In notifyRewardAmount function, if Admin added a reward 100 once block.timestamp = periodFinish. Now if Admin decides to add 200 rewards calling this function at block.timesta...

MyBB Admin Control Panel Remote Code Execution (CVE-2022-24734)

A code injection vulnerability exists in MyBB. The vulnerability is due to insufficient input validation when parsing user input sent to Admin Control Panel...

Multi Language-Pharmacy Management System v1.0 SQL injection Vulnerability

Title: Multi Language-Pharmacy Management System v1.0 SQLi Author: nu11secur1ty Vendor: https://www.sourcecodester.com/users/mayurik Software: https://www.sourcecodester.com/php/15281/multi-language-pharmacy-management-system-project-source-code.html Reference:...

Might not get desired min loan amount if _originationFeeRate changes

Lines of code Vulnerability details Impact Admins can update the origination fee by calling updateOriginationFeeRate. Note that a borrower does not receive their minLoanAmount set in createLoan, they only receive 1 - originationFee minLoanAmount, see lend. Therefore, they need to precalculate the...

[WP-H8] Admin of the upgradeable proxy contract (the diamond contract) can rug users

Lines of code Vulnerability details Use of Upgradeable Proxy Contract Structure The Diamond Structure allows the logic of the contract to be arbitrarily changed. This allows the proxy admin to perform malicious actions e.g., taking funds from users' wallets up to the allowance limit. This action...

Renouncepauser function is dangerous

Lines of code Vulnerability details Impact If pauser makes an error all the protocol will be unusable Proof of Concept The funtion renouncePauserPausable.sol which affect several contracts is dangerous. function renouncePauser external virtual onlyPauser emit PauserChangedpauser, address0; pauser...