91 matches found
GHSA-3HWC-RQWP-V36Q Apache Solr can leak certain passwords due to System Property redaction logic inconsistencies
Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...
DEBIAN-CVE-2023-50291
Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...
PT-2024-1632 · Apache · Apache Solr
Name of the Vulnerable Software and Affected Versions: Apache Solr versions 6.0.0 through 8.11.2 Apache Solr versions 9.0.0 through 9.2.x Description: The issue is related to insufficient protection of credentials in Apache Solr. One of the endpoints, "/admin/info/properties", was only set up to...
CVE-2023-1634
A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/infodeal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit ha...
CVE-2020-21126
MetInfo 7.0.0 contains a Cross-Site Request Forgery CSRF via admin/?n=admin&c=index&a=doSaveInfo...
CVE-2020-20586
A cross site request forgery CSRF vulnerability in the /xyhai.php?s=/Auth/editUser URI of XYHCMS V3.6 allows attackers to edit any information of the administrator such as the name, e-mail, and password...
The vulnerability of the admin/info.php?shuyu component of the LAOBANCMS software allows a hacker to execute arbitrary code.
The vulnerability of the admin/info.php?shuyu component of the LAOBANCMS software is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2021-3604 Primion-Digitek Secure 8 SQL injection vulnerability
Secure 8 Evalos does not validate user input data correctly, allowing a remote attacker to perform a Blind SQL Injection. An attacker could exploit this vulnerability in order to extract information of users and administrator accounts stored in the database...
CVE-2020-36006
AppCMS 2.0.101 in /admin/info.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitrary files on the site...
CVE-2020-36006
AppCMS 2.0.101 in /admin/info.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitrary files on the site...
CVE-2020-18167
Cross Site Scripting XSS in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Homepage Introduction" field of component "admin/info.php?shuyu"...
LAOBANCMS 跨站脚本漏洞
LAOBANCMS is a content management system based on PHP and MySQL. A cross-site scripting vulnerability exists in LAOBANCMS v2.0 that allows remote attackers to execute arbitrary code by injecting a command into the "Homepage Introduction" field of the component "admin/info.php?shuyu". field of the...
CVE-2020-18165
Cross Site Scripting XSS in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Website SEO Keywords" field on the page "admin/info.php?shuyu"...
Online shopping system advanced 1.0 - 'p' SQL Injection
Exploit Title: Online shopping system advanced 1.0 - 'p' SQL Injection Exploit Author : Majid kalantari Date: 2020-04-26 Vendor Homepage : https://github.com/PuneethReddyHC/online-shopping-system-advanced Software link:...
Yoti: [www.yoti.com] Wordpress user admin information discloure
Summary This website using Wordpress CMS, so developer forget to disable the link that can view information of admin user. By access to this link, attacker can get all username and other information of user admin: https://www.yoti.com/wp-json/wp/v2/users ████ Admin user list: 1. ███████ 1. █████ ...
CVE-2018-10736
A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter...
ShopBuilder 5.6.1 /module/news/admin/newslist.php did SQL注入漏洞
No description provided by source. !/usr/bin/env python coding=utf-8 import re import urllib2 from comm import cmdline from comm import generic pocinfo = 'VulId': '1565', 'Name': 'ShopBuilder 5.6.1 /module/news/admin/newslist.php did SQL注入漏洞 POC', 'AppName': 'ShopBuilder', 'AppPowerLink':...
SuperCali PHP Event Calendar 0.4.0 - SQL Injection Vulnerability
No description provided by source. --==+================================================================================+==-- --==+ SuperCali Event Calendar SQL Injection Vulnerbility +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz...
PHP Classifieds Script <= 05122008 SQL Injection Vulnerabilities
No description provided by source. || || | || o,7 || . o7 || 4||| ow, : / / . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| | | | /' \ /'\ /\ \ /'\ /\ \ | | /, \ /\/\L\ \ \ \ ,/\ /\ \ \ \ / | | //\ \ /' \ /\ //\ /'\ \ /\ \ \ \ /'\ \ | | \ \ /\ /\ \ \ \ /...
Softbiz Resource Repository Script Blind SQL Injection Vulnerability
No description provided by source. $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ $ Softbiz Resource repository script Blind SQL Vulnerability Normal version $ Author : Sangteamtham $ Home : Hcegroup.net & vnbrain.net $ Download...