2398 matches found
Cross site scripting
The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues...
CVE-2017-18493
The CVE-2017-18493 entry concerns the WordPress plugin Custom Admin Page by BestWebSoft
CVE-2016-10865
The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery CSRF via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS...
CVE-2019-14679
core/views/arpriceimportexport.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arpliteimportexport CSRF...
Design/Logic Flaw
The woo-variation-swatches aka Variation Swatches for WooCommerce plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter...
CVE-2019-14335
An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated denial of service leading to the reboot of the AP via the admin.cgi?action=%s URI...
Authentication Bypass
yourls is vulnerable to authentication bypass. The authentication functions consist of a type-juggling vulnerability that allows an attacker to use non-strict comparisons to bypass authentication and perform unauthorized actions in the admin page and API...
PT-2019-13776 · WordPress · Admin-Renamer-Extended
Name of the Vulnerable Software and Affected Versions: admin-renamer-extended plugin version 3.2.1 Description: The issue allows for a CSRF attack on the wp-admin/plugins.php?page=admin-renamer-extended/admin.php page. Recommendations: For admin-renamer-extended plugin version 3.2.1, consider...
CVE-2019-9885
eClass platform ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenviewleft.php StudentID parameter...
CVE-2019-9884
eClass platform ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page...
Design/Logic Flaw
eClass platform ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page...
Facebook Messenger Customer Chat Plugin - Critical - Access bypass - SA-CONTRIB-2019-059
The Facebook Messenger Customer Chat Plugin module enables you to add the Facebook Messenger Customer Chat Plugin to your Drupal site. The module doesn't require user permissions on the admin page...
Default credentials
LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the customlogo filename suffix is not restricted, and .php may be used...
CVE-2018-17147
Nagios XI before 5.5.4 has XSS in the auto login admin management page...
CVE-2018-17147
Nagios XI before 5.5.4 has XSS in the auto login admin management page...
CVE-2018-17147
Nagios XI before 5.5.4 has XSS in the auto login admin management page...
Watu Quizz <= 3.1.2.5 - Reflected XSS via question-form.html.php
The Watu Quiz WordPress plugin was affected by a Reflected XSS via question-form.html.php security vulnerability. /wp-admin/admin.php?page=watuquestion&question=1&action=edit&quiz=1"...
Sql injection
FreePBX 13 and 14 has SQL Injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page...
CVE-2018-18872
The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the eventtitle parameter in a wp-admin/admin.php?page=calendar add action, or the category name during category creation at the wp-admin/admin.php?page=calendar-categories URI...