PT-2024-20897 · Unknown · Phpgurukul Zoo Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Zoo Management System version 1.0 Description: The issue allows attackers to run arbitrary SQL commands via the editid parameter in the /zms/admin/changeimage.php API endpoint. This enables attackers to potentially extract or modif...

PT-2024-18347 · Sourcecodester · Sourcecodester Complete File Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Complete File Management System version 1.0 Description: A critical vulnerability has been found in the Admin Login Form component of the file /admin/. The manipulation of the username argument with a specific input leads to SQ...

PT-2024-21055 · Alf.Io · Alf.Io

Name of the Vulnerable Software and Affected Versions: alf.io versions prior to 2.0-Mr-2402 Description: The issue allows organization owners to view the generated API KEY and USERS of other organization owners. This is achieved through the "http://192.168.26.128:8080/admin/api/users/" endpoint,...

PT-2024-14586 · Caddy · Caddy +1

Name of the Vulnerable Software and Affected Versions: caddy-security plugin for Caddy version 1.1.20 Description: The issue allows reflected Cross-site Scripting XSS via a GET request to a URL that contains an XSS payload and begins with either a "/admin" or "/settings/mfa/delete/" substring. Th...

UBUNTU-CVE-2023-50291

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...

PT-2024-20883 · Code Projects · Code-Projects Hotel Managment System

Name of the Vulnerable Software and Affected Versions: Code-projects Hotel Managment System version 1.0 Description: The issue allows SQL Injection via the sid parameter in the "Hotel/admin/show.php?sid=2" endpoint. This means an attacker could potentially inject malicious SQL code by manipulatin...

CVE-2024-22593

FlyCms v1.0 contains a Cross-Site Request Forgery CSRF vulnerability via /system/admin/addgroupsave...

PT-2024-19498 · Flycms · Flycms

Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. It occurs via the "/system/admin/add group save" API endpoint. This allows for potentially unauthorized actions to be performed on behalf of an...

PT-2024-19008 · Pimcore · Pimcore Customer Management Framework

Name of the Vulnerable Software and Affected Versions: Pimcore Customer Management Framework versions prior to 4.0.6 Description: The issue allows an authenticated and unauthorized user to access the list of potential duplicate users and see their data. This occurs because permissions are not...

PT-2023-31752 · S Cms · S-Cms

Name of the Vulnerable Software and Affected Versions: S-CMS version 5.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the A textauth parameter at the "/admin/ajax.php" API endpoint. Recommendations: For S-CMS version 5.0, consider...

PT-2023-31751 · S Cms · S-Cms

Name of the Vulnerable Software and Affected Versions: S-CMS version 5.0 Description: The issue is a SQL injection vulnerability. It occurs via the A productauth parameter at the "/admin/ajax.php" API endpoint. Recommendations: For S-CMS version 5.0, consider restricting access to the...

Cross site request forgery (csrf)

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/category/delete...

PT-2023-31195 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS version 5.0.0 Description: A Cross-Site Request Forgery CSRF issue was discovered in JFinalCMS. The vulnerability can be exploited via the "/admin/friend link/delete" API endpoint. Recommendations: For JFinalCMS version 5.0.0, as a...

JFinalCMS Security Vulnerability

JFinalCMS is a content management system by heyewei personal developer. A security vulnerability exists in JFinalCMS v5.0.0, which originates from a cross-site request forgery vulnerability in the /admin/friendlink/delete component...

PT-2023-31202 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS version 5.0.0 Description: A Cross-Site Request Forgery CSRF issue was discovered in JFinalCMS. The vulnerability can be exploited via the "/admin/category/save" API endpoint. Recommendations: For JFinalCMS version 5.0.0, update to ...

PT-2023-31015

Name of the Vulnerable Software and Affected Versions DaiCuo version 2.5.15 Description A stored cross-site scripting XSS issue in the /admin.php endpoint allows attackers to execute arbitrary web scripts or HTML via a crafted payload. This can lead to the execution of malicious code on the...

PT-2023-30442 · Webid · Webid

Name of the Vulnerable Software and Affected Versions: WeBid versions 1.2.2 and earlier Description: The issue allows for code injection via the "admin/categoriestrans.php" endpoint. This could potentially lead to unauthorized access or control of the system. Recommendations: For WeBid versions...

Service Provider Management System Security Vulnerability

Service Provider Management System is a web-based application developed by Carlo Montero, an individual developer. It is designed to provide dynamic web sites for service provider companies. A security vulnerability exists in Service Provider Management System version v.1.0 that originates from a...

DiDi KnowSearch Security Breach

DiDi KnowSearch is a zero-intrusion, multi-tenant Elasticsearch GUI control platform built around clustering and indexing for Elasticsearch R&D and O&M staff at China's DiDi. A security vulnerability exists in didi KnowSearch versions 0.3.2 and 0.3.1.2, which stems from certain unknown processing...

CVE-2023-38206

Adobe ColdFusion versions 2018u18 and earlier, 2021u8 and earlier and 2023u2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints...