PT-2024-26294 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: The issue is a Cross-Site Request Forgery CSRF that affects the idccms software. It occurs via the "admin/tplSys deal.php?mudi=area" endpoint. This allows for unauthorized actions to be performed on behalf of ...

idcCMS 安全漏洞

Net Titanium Technology idcCMS Net Titanium IDC Cloud Management Agent System is a cloud management agent system from China's Net Titanium Technology Net Titanium Technology. A security vulnerability exists in idcCMS v1.35, which was discovered via the component admin/sysImagesdeal.php?mudi=infoS...

CVE-2024-4823

Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the index '/schoolerp/officeadmin/' in the parameters esbankacc, esbankname, esbankpin, escheckno, estellernumber, dc1 and dc2. An attacker could send a specially crafted JavaScript payload to an authenticated user and partially...

PT-2024-26292 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: A Cross-Site Request Forgery CSRF issue was discovered in the component "/admin/infoType deal.php?mudi=add&nohrefStr=close". Recommendations: For idccms version 1.35, consider disabling access to the...

PT-2024-26288 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: The issue is related to a Cross-Site Request Forgery CSRF in the component /admin/share switch.php. This component is vulnerable due to the presence of certain parameters, including mudi, dataType, fieldName,...

PT-2024-26291 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: A Cross-Site Request Forgery CSRF issue was discovered in the component "/admin/infoType deal.php" with parameters mudi and nohrefStr. This allows for unauthorized requests. Recommendations: For idccms version...

CVE-2024-33830

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/readDeal.php?mudi=clearWebCache...

PT-2024-24133 · Unknown · Computer Laboratory Management System

Name of the Vulnerable Software and Affected Versions: Computer Laboratory Management System version 1.0 Description: The issue allows for SQL Injection via the "id" parameter of the "/admin/?page=user/manage user&id=6" API endpoint. This means an attacker could potentially inject malicious SQL...

PT-2024-27825 · Unknown · Wbsairback

Name of the Vulnerable Software and Affected Versions: WBSAirback version 21.02.04 Description: The issue is a stored Cross-Site Scripting XSS vulnerability, which occurs through the /admin/DeviceReplication endpoint, specifically in the execution range field, and affects all parameters. This cou...

PT-2024-23642 · Netentsec · Netentsec Ns-Asg

Name of the Vulnerable Software and Affected Versions: netentsec NS-ASG version 6.3 Description: The issue concerns SQL Injection, which can be exploited via the "/admin/config ISCGroupTimePolicy.php" API endpoint. Recommendations: For netentsec NS-ASG version 6.3, consider restricting access to...

PT-2024-23645 · Netentsec · Netentsec Ns-Asg

Name of the Vulnerable Software and Affected Versions: netentsec NS-ASG version 6.3 Description: The issue is related to SQL Injection, which can be exploited via the /admin/edit virtual site info.php API endpoint. Recommendations: For netentsec NS-ASG version 6.3, consider restricting access to...

PT-2024-23646 · Netentsec · Netentsec Ns-Asg

Name of the Vulnerable Software and Affected Versions: netentsec NS-ASG version 6.3 Description: The issue is related to SQL Injection. It can be exploited via the "/admin/add getlogin.php" API endpoint. Recommendations: For netentsec NS-ASG version 6.3, consider restricting access to the...

PT-2024-23648 · Netentsec · Netentsec Ns-Asg

Name of the Vulnerable Software and Affected Versions: netentsec NS-ASG version 6.3 Description: The issue is related to SQL Injection, which can be exploited via the "/admin/address interpret.php" API endpoint. There is no information provided about the estimated number of potentially affected...

PT-2024-23337 · Netentsec · Netentsec Ns-Asg Application Security Gateway

Name of the Vulnerable Software and Affected Versions: Netentsec NS-ASG Application Security Gateway version 6.3 Description: A critical vulnerability was found in the Netentsec NS-ASG Application Security Gateway. This issue affects an unknown part of the file /admin/list crl conf. The...

PT-2024-22852 · Sourcecodester · Sourcecodester Php Task Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester PHP Task Management System version 1.0 Description: The issue is related to SQL Injection via the update-admin.php endpoint, specifically through the admin id parameter. This allows for potential exploitation. No information is...

PT-2024-21988 · Unknown · Campcodes Complete Online Beauty Parlor Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Complete Online Beauty Parlor Management System version 1.0 Description: A critical issue was found in the system, affecting an unknown function of the file /admin/edit-services.php. The manipulation of the editid argument leads to...

PT-2024-21181 · Amss++ · Amss++

Name of the Vulnerable Software and Affected Versions: AMSS++ version 4.31 Description: The issue allows SQL injection through the /amssplus/admin/index.php endpoint, in the id parameter. This could enable a remote attacker to send a specially crafted SQL query to the server and retrieve all the...

CVE-2023-52555

In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection...

PT-2024-18699 · Unknown · Mini-Tmall

Name of the Vulnerable Software and Affected Versions: Mini-Tmall versions up to 20231017 Description: A critical issue affects the processing of the file at the endpoint "?r=tmall/admin/user/1/1". The manipulation of the orderBy argument leads to SQL injection. The attack can be initiated...

CVE-2023-52555

The mongo-express web-based management interface, specifically version 1.0.2 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The flaw exists in the /admin endpoint, where an attacker could potentially perform unauthorized actions, such as the deletion of a Collection . To mitigate ...