PT-2022-16545

Name of the Vulnerable Software and Affected Versions eliteCMS version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the "/admin/edit user.php" API endpoint. Recommendations For eliteCMS version 1.0, as a temporary workaround,...

PT-2022-16543

Name of the Vulnerable Software and Affected Versions eliteCMS version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the "/admin/edit post.php" API endpoint. Recommendations For eliteCMS version 1.0, as a temporary workaround,...

CVE-2021-46446

H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=adminaccessgroupedit&aagID...

CVE-2020-36496

DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting XSS vulnerabilities in the component sysadminuseredit.php via the filename, mid, userid, and templet' parameters...

CVE-2020-19047

Cross Site Request Forgey CSRF in iWebShop v5.3 allows remote atatckers to execute arbitrary code via malicious POST request to the component '/index.php?controller=system&action=admineditact'...

PT-2021-10276

Name of the Vulnerable Software and Affected Versions: iWebShop version 5.3 Description: The issue allows remote attackers to execute arbitrary code via a malicious POST request to the "/index.php?controller=system&action=admin edit act" API endpoint. This is a Cross Site Request Forgery CSRF...

getsimplecms cross-site scripting vulnerabilities

GetSimple CMS is an XML-based, completely self-contained, streamlined content management system. A cross-site scripting vulnerability exists in admin/edit.php in GetSimple CMS version 3.4.0a. An attacker can exploit this vulnerability to conduct a cross-site scripting attack...

CVE-2020-18264

Cross Site Request Forgery CSRF in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/admin.php?act=acteditmember"...

Pluck Cross-Site Request Forgery Vulnerability

Pluck is a small and simple content management system CMS written in PHP. A cross-site request forgery vulnerability exists in Pluck version 4.7.10-dev2. An attacker can exploit this vulnerability to edit a page via /admin.php?action=editpage...

CVE-2020-19109

SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to adminedit.php, which could let a remote malicious user execute arbitrary code...

PHPGurukul Online Book Store SQL Injection Vulnerability

PHPGurukul Online Book Store is a PHP-based online bookstore website system. A SQL injection vulnerability exists in Online Book Store v1.0. The vulnerability can be exploited to execute arbitrary code via the bookisbn parameter of adminedit.php...

UBUNTU-CVE-2020-13566

SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability In admin/editgroup.php, when the POST parameter action is “Delete”, the POST parameter deletegroup leads to a SQL...

UBUNTU-CVE-2020-13568

SQL injection vulnerability exists in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability in admin/editgroup.php, when the POST parameter action is “Submit”, the POST parameter parentid leads to a SQL...

phpGACL SQL injection vulnerability

phpGACL is an open source PHP class for Web developers to provide a simple but powerful "insert" permission system . For its current Web-based applications to use . Phpgacl version 3.3.7 SQL injection vulnerability , the vulnerability stems from the program admin/edit group.php page SQL injection...

PT-2021-18037

Name of the Vulnerable Software and Affected Versions: Bitweaver version 3.1.0 Description: A cross-site scripting XSS issue allows remote attackers to inject JavaScript via the "/users/admin/edit group.php" API endpoint. This enables attackers to execute malicious scripts on the client-side...

PT-2021-9640 · Phpgacl · Phpgacl

Name of the Vulnerable Software and Affected Versions: phpGACL version 3.3.7 Description: The issue allows for SQL injection through a specially crafted HTTP request. In the file admin/edit group.php, when the POST parameter action is set to “Delete”, the POST parameter delete group can lead to a...

CVE-2020-13157

modules\users\admin\edit.php in NukeViet 4.4 allows CSRF to change a user's password via an admin/index.php?nv=users&op=edit&userid= URI. The old password is not needed...

DEVOME GRR Code Issue Vulnerability

DEVOME GRR is a resource management and reservation system. A code issue vulnerability exists in DEVOME GRR versions prior to 3.4.1c that stems from the admineditroom.php file failing to properly handle file uploads. A remote attacker could exploit this vulnerability to execute code...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-18326)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflective cross-site scripting vulnerability exists in admin/edit-template.php in Chadha PHPKB Standard Multi-Language version 9...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-18334)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflective cross-site scripting vulnerability exists in admin/edit-comment.php in Chadha PHPKB Standard Multi-Language version 9...