933 matches found
GHSA-QCRJ-6FFC-V7HQ Craft CMS Stored Cross-site Scripting Injection Vulnerability
Summary When you insert a payload inside a label name or instruction of an entry type, an XSS happens in the quick post widget on the admin dashboard. PoC Complete instructions, including specific configuration details, to reproduce the vulnerability. Impact Tested with the free version of Craft...
CVE-2023-23927 Craft CMS stored cross-site scripting vulnerability
Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting XSS happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7...
CVE-2023-23927
Craft CMS is vulnerable to a stored XSS in the quick post widget on the admin dashboard when a payload is inserted into a label name or an entry type instruction. The issue affects Craft CMS prior to version 4.3.7 and has been fixed in 4.3.7. The CVE entry is supported by multiple connected sourc...
CVE-2023-23927 Craft CMS stored cross-site scripting vulnerability
Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting XSS happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7...
CVE-2023-23927 Craft CMS stored cross-site scripting vulnerability
Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting XSS happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7...
Thingsboard 安全漏洞
Thingsboard is a Java-based platform for monitoring, management, and data collection of IOT devices from the Thingsboard team. A security vulnerability exists in Thingsboard version 3.4.1, which stems from the fact that a tenant administrator can modify the scope of the scopes parameter to gain...
Metform Elementor Contact Form Builder < 3.2.0 - Unauthenticated Stored XSS
The plugin does not sanitize and escape some of its submitted entry data when outputting them back in the admin dashboard, which could allow unauthenticated attackers to perform Stored XSS attacks against an admin viewing the malicious entry Setup as admin: Create a new form using MetForm Element...
Metform Elementor Contact Form Builder < 3.2.0 - Unauthenticated Stored XSS
The plugin does not sanitize and escape some of its submitted entry data when outputting them back in the admin dashboard, which could allow unauthenticated attackers to perform Stored XSS attacks against an admin viewing the malicious entry PoC Setup as admin: Create a new form using MetForm...
PT-2022-9076 · Arcadyan · Arcadyan Wifi Routers Vrv9506Jac23
Name of the Vulnerable Software and Affected Versions: Arcadyan Wifi routers VRV9506JAC23 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the hostName and domain name parameters present in the LAN configuration section of the administrative dashboard. Thi...
CVE-2022-38813
PHPGurukul Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, delete the users, add and manage Blood Group, and Submit Report...
Record Management System Access Control Error Vulnerability
Teachers Record Management System is an open source Teachers Record Management System. Record Management System v1.0 suffers from an Access Control Error vulnerability that originates from improper access control in /Admin/dashboard.php. An attacker can exploit this vulnerability to access and...
CVE-2022-38813
PHPGurukul Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, delete the users, add and manage Blood Group, and Submit Report...
PHPGurukul Blood Donor Management System 安全漏洞
PHPGurukul Blood Donor Management System is a blood donor management system from the US company PHPGurukul. A security vulnerability exists in version 1.0 of the PHPGurukul Blood Donor Management System that stems from not properly restricting access to admin/dashboard.php, which can be exploited...
Teachers Record Management System 安全漏洞
Teachers Record Management System is an open source Teachers Record Management System. Record Management System v1.0 suffers from an Access Control Error vulnerability that originates from improper access control in /Admin/dashboard.php. An attacker can exploit this vulnerability to access and...
PT-2022-25876 · Unknown · Record Management System +1
Name of the Vulnerable Software and Affected Versions: Record Management System using CodeIgniter version 1.0 Description: The issue allows attackers to access and modify user data due to an access control problem in the /Admin/dashboard.php endpoint. Recommendations: For Record Management System...
Exploit for Exposure of Resource to Wrong Sphere in Phpgurukul_Blood_Donor_Management_System_Project Phpgurukul_Blood_Donor_Management_System
CVE-2022-38813 Veritical Privilege Escalation via user parame...
eCommerce Product Catalog Plugin for WordPress < 3.0.72 - Reflected XSS
The plugin does not sanitise and escape some parameter before outputting them back in attributes and JS code in admin dashboards, leading to Reflected Cross-Site Scripting PoC Make a logged in admin open one of the URLs below...
CVE-2022-42238
A Vertical Privilege Escalation issue in Merchandise Online Store v.1.0 allows an attacker to get access to the admin dashboard...
