Sql injection

Online Tours And Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the tname parameter at /admin/operations/tax.php...

Online Tours And Travels Management System SQL注入漏洞

Online Tours And Travels Management System is an online tour management system. v1.0 of Online Tours And Travels Management System is vulnerable to SQL injection, which originates from /admin/operations/tax. The tname parameter in php lacks validation for external input SQL statements. An attacke...

CVE-2022-32992: Improper Neutralization of Special Elements used in an SQL Command

Online Tours And Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the tname parameter at /admin/operations/tax.php...

Important: mailman

Issue Overview: Cross-site request forgery CSRF vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's...

mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover

A Cross-Site Request Forgery CSRF attack can be performed in mailman due to a CSRF token bypass. CSRF tokens are not checked against the right type of user when performing admin operations and a token created by a regular user can be used by an admin to perform an admin-level request, effectively...

CVE-2020-17533

Summary of CVE-2020-17533 (Apache Accumulo) Root cause: Insufficient verification of the return values from policy-enforcement functions canFlush and canPerformSystemActions, allowing an authenticated user with limited permissions to perform restricted administrative operations. Affected versions...

Weak Password Vulnerability in the Backend of NetSense SecBMS 3600 Bandwidth Management System

NetShen Information Technology Beijing Co., Ltd. specializes in network and information security. A weak password vulnerability exists in the backend of NetShen SecBMS 3600 Bandwidth Management System, which can be exploited by an attacker to log in to the system with a weak password and perform...

Input validation

Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted...

CVE-2020-11532

Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to bypass authentication for this server and execute all operations in the context of admin user...

CVE-2020-11532

Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to bypass authentication for this server and execute all operations in the context of admin user...

Path traversal

Path Traversal in admin/imagepaster/operations.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete any folder on the webserver using a dot-dot-slash sequence ../ via the GET parameter crdir, when the GET parameter action is set to df, causing a Denial of Service...

CMSsite 1.0 Cross Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: CMSsite 1.0 - Cross-Site Request Forgery Delete Admin Exploit Author: Mr Winst0n Author E-mail: [email protected] Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link :...

The vulnerability of Siemens TIM’s switching module’s microprogramming software lies in the lack of authentication for the critical network service function at port 102/TCP. This allows attackers to perform arbitrary administrative operations.

The vulnerability of Siemens TIM’s communication module’s microprogramming software is related to the lack of authentication for the critical network service function at port 102/TCP. Exploiting this vulnerability allows a perpetrator to perform arbitrary administrative operations...

Design/Logic Flaw

IBM Security Access Manager Appliance 9.0.3.1, 9.0.4.0 and 9.0.5.0 could allow unauthorized administration operations when Advanced Access Control services are running. IBM X-Force ID: 150998...

CVE-2018-15193

A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link...

CVE-2018-15193

A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link...

CVE-2018-15193

A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link...

CVE-2018-15193: Cross-Site Request Forgery (CSRF)

A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link...

CVE-2015-7792

Corega CG-WLBARGS devices allow remote attackers to perform administrative operations via unspecified vectors...

[SECURITY] Fedora 20 Update: python-django-horizon-2013.2.3-1.fc20

Horizon is a Django application for providing Openstack UI components. It allows performing site administrator viewing account resource usage, configuring users, accounts, quotas, flavors, etc. and end user operations start/stop/delete instances, create/restore snapshots, view instance VNC consol...