2398 matches found
CVE-2022-25115
A remote code execution RCE vulnerability in the Avatar parameter under /admin/?page=user/manageuser of Home Owners Collection Management System v1.0 allows attackers to execute arbitrary code via a crafted PNG file...
Remote code execution
A remote code execution RCE vulnerability in the Avatar parameter under /admin/?page=user/manageuser of Home Owners Collection Management System v1.0 allows attackers to execute arbitrary code via a crafted PNG file...
CVE-2022-25115
A remote code execution RCE vulnerability in the Avatar parameter under /admin/?page=user/manageuser of Home Owners Collection Management System v1.0 allows attackers to execute arbitrary code via a crafted PNG file...
Bank Mellat <= 1.3.7 - Reflected Cross-Site Scripting
The plugin does not sanitize and escape the orderId parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. PoC https://example.com/wp-admin/admin.php?page=bank-mellat="...
Database Peek <= 1.2 - Reflected Cross-Site Scripting
The plugin does not sanitize and escape the match parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. https://example.com/wp-admin/admin.php?page=ab-database-peek&table=wpusers&match="...
Delete Old Orders <= 0.2 - Reflected Cross-Site Scripting
The plugin does not sanitize and escape the date parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. PoC https://example.com/wp-admin/admin.php?page=woo-delete-old-orders=3="...
Database Peek <= 1.2 - Reflected Cross-Site Scripting
The plugin does not sanitize and escape the match parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. PoC https://example.com/wp-admin/admin.php?page=ab-database-peek=wpusers="...
dTabs <= 1.4 - Reflected Cross-Site Scripting
The plugin does not sanitize and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. PoC https://example.com/wp-admin/options-general.php?page=dtabs.php=edit="...
AyaCms 代码注入漏洞
AyaCms is an extremely simple and free open source Php website builder. A remote code execution vulnerability exists in AyaCMS version 3.1.2, which stems from a failure to properly filter special elements in the /aya/module/admin/usttabe.inc.php page. An attacker could exploit this vulnerability ...
Mapping Multiple URLs Redirect Same Page <= 5.8 - Reflected Cross-Site Scripting
The plugin does not sanitize and escape the mmurspid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. PoC https://example.com/wp-admin/admin.php?page=mmursp-list=editid="...
CVE-2022-25412
Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /adminpage/all-files-update-ajax.php via the dir and deletefile parameters...
CVE-2022-25412
Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /adminpage/all-files-update-ajax.php via the dir and deletefile parameters...
CVE-2021-24994 WPvivid Backup and Migration Plugin < 0.9.69 - Unauthenticated Stored Cross-Site Scripting
The Migration, Backup, Staging WordPress plugin before 0.9.69 does not have authorisation when adding remote storages, and does not sanitise as well as escape a parameter from such unauthenticated requests before outputting it in admin page, leading to a Stored Cross-Site Scripting issue...
SEO Plugin by Squirrly SEO < 11.1.12 - Reflected Cross-Site Scripting
The plugin does not escape the type parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=sqbulkseo=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28/XSS/%29+xxx=pp...
AP Mega Menu < 3.0.8 - Reflected Cross-Site Scripting
The plugin does not sanitize and escape the wpnonce parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. https://example.com/wp-admin/admin.php?page=wpmm-add-theme&wpnonce="...
AP Mega Menu < 3.0.8 - Reflected Cross-Site Scripting
The plugin does not sanitize and escape the wpnonce parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. PoC https://example.com/wp-admin/admin.php?page=wpmm-add-theme&wpnonce="...
WordPress plugin跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in...
MaxSite CMS 跨站脚本漏洞
MaxSite CMS is a web content management system of the Russian MaxSite CMS open source project.MaxSite CMS 108 has a cross-site scripting vulnerability that can be exploited by attackers to perform cross-site scripting attacks via the ftags parameter in /admin/pageedit/3...
