CVE-2015-10080 NREL api-umbrella-web Admin Data Table cross site scripting

A vulnerability was found in NREL api-umbrella-web 0.7.1. It has been classified as problematic. This affects an unknown part of the component Admin Data Table Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 0.8.0 is ab...

CVE-2015-10080 NREL api-umbrella-web Admin Data Table cross site scripting

A vulnerability was found in NREL api-umbrella-web 0.7.1. It has been classified as problematic. This affects an unknown part of the component Admin Data Table Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 0.8.0 is ab...

API Umbrella Web 跨站脚本漏洞

API Umbrella Web is an open source library from National Renewable Energy Laboratory. A cross-site scripting vulnerability exists in API Umbrella Web version 0.7.1, which stems from an issue with an unknown portion of the component Admin Data Table Handler that can lead to a cross-site scripting...

CVE-2022-25625

A malicious unauthorized PAM user can access the administration configuration data and change the values...

GHSA-2RR8-9C6G-8J5C Missing Authorization in Crafter CMS

In Crafter CMS Crafter Studio 3.0 prior to 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data...

CVE-2022-0837

The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing any customer to send paid test SMS notification as well as retrieve sensitive information about the admin, such as the email, account balance and payment history. A malicious...

WordPress plugin Amelia安全漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress plugin is a WordPress open source application plugin. WordPress Amelia plugin is vulnerable to a...

CVE-2022-26573

Maccms v10 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities in /admin.php/admin/art/data.html via the select and input parameters...

PT-2022-17937

Name of the Vulnerable Software and Affected Versions Maccms version 10 Description The issue is related to multiple reflected cross-site scripting XSS vulnerabilities. These vulnerabilities are found in the /admin.php/admin/art/data.html endpoint via the select and input parameters...

Code Injection in publify/publify

Description The application doesn't check/filter the comments provided by the user before save to database. Attacker can't insert js code to steal admin's data but can insert html code, leads to many information security risks. Proof of Concept - Step 1: Go to...

CVE-2021-44837

An issue was discovered in Delta RM 1.2. It is possible for an unprivileged user to access the same information as an admin user regarding the risk creation information in the /risque/administration/referentiel/json/create/categorie endpoint, using the idcat1 query parameter to indicate the risk...

WordPress 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress MouseWheel Smooth Scroll plugin in versions...

CVE-2021-32022

A low privileged delete vulnerability using CEF RPC server of BlackBerry Protect for Windows versions versions 1574 and earlier could allow an attacker to potentially execute code in the context of a BlackBerry Cylance service that has admin rights on the system and gaining the ability to delete...

CVE-2021-31737

emlog v5.3.1 and emlog v6.0.0 have a Remote Code Execution vulnerability due to upload of database backup file in admin/data.php...

Crafter CMS Permission License and Access Control Issues Vulnerability

Crafter CMS is an open source content management system CMS for digital experience applications. A vulnerability in privilege permission and access control issues exists in Crafter CMS Crafter Studio version 3.0.1, which stems from a vulnerability that allows an unauthenticated attacker to view a...

PT-2020-8125

Name of the Vulnerable Software and Affected Versions: Crafter Studio version 3.0.1 Crafter Studio versions prior to 3.0.1 Description: An IDOR vulnerability exists in Crafter Studio, allowing unauthenticated attackers to view and modify administrative data. Recommendations: For Crafter Studio...

GLPI Permission License and Access Control Issues Vulnerability

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...

Cross site request forgery (csrf)

Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can be accessed via a simple request...

CVE-2020-11551

An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite SRS60 AC3000 V2.5.1.106, Outdoor Satellite RBS50Y V2.5.1.106, and Pro Tri-Band Business WiFi Router SRR60 AC3000 V2.5.1.106. The administrative SOAP interface allows an unauthenticated remote write of arbitrary Wi-Fi...

XSS Vulnerability in Cicada Knowledge Enterprise Portal System

Cicada Knowledge Enterprise Portal System is an open source and free enterprise portal system. Cicada Knowledge Enterprise Portal System EPS 8.0 has an XSS vulnerability, users can use the front posting and reply function to upload malicious attachments, which leads to the administrator in the...