2394 matches found
CVE-2024-53255 Reflected Cross-site Scripting in /admin?page=media via file Parameter in BoidCMS
BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In affected versions a reflected Cross-site Scripting XSS vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to...
PT-2024-35694 · Boidcms · Boidcms
Name of the Vulnerable Software and Affected Versions: BoidCMS versions prior to 2.1.2 Description: A reflected Cross-site Scripting XSS issue exists in the "admin?page=media" endpoint, specifically in the file parameter, allowing an attacker to inject arbitrary JavaScript code. This could lead t...
CVE-2024-11493
A vulnerability classified as problematic was found in 115cms up to 20240807. This vulnerability affects unknown code of the file /index.php/setpage/admin/pageAE.html. The manipulation of the argument tid leads to cross site scripting. The attack can be initiated remotely. The exploit has been...
CVE-2024-11489
A vulnerability was found in 115cms up to 20240807. It has been classified as problematic. Affected is an unknown function of the file /index.php/admin/web/file.html. The manipulation of the argument ks leads to cross site scripting. It is possible to launch the attack remotely. The exploit has...
CVE-2024-51209
Cross-Site Scripting XSS vulnerabilities in Anuj Kumar's Client Management System Version 1.2 allow local attackers to inject arbitrary web script or HTML via the search input field parameter to admin search invoice page and client search invoice page...
PT-2024-17032 · 115Cms · 115Cms
Name of the Vulnerable Software and Affected Versions: 115cms versions up to 20240807 Description: A problematic vulnerability was found in 115cms, affecting an unknown part of the file /index.php/setpage/admin/pageAE.html. The manipulation of the tid argument leads to cross-site scripting. The...
CVE-2024-50842
A Stored Cross-Site Scripting XSS vulnerability was found in /admin/schoolyear.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the schoolyear parameter...
Job Recruitment 注入漏洞
Job Recruitment is a job portal project developed by code-projects using PHP, CSS, JavaScript, and MySQL technologies. An injection vulnerability exists in Job Recruitment version 1.0, which stems from an SQL injection vulnerability in the userid parameter of the admin.php page...
CVE-2023-29119
CVE-2023-29119 affects Waybox Enel X web management application. Reported vulnerability allows arbitrary requests on the internal database via the/web path /admin/dbstore.php, as described in multiple sources (NVD entry, Red Hat advisory, CVE list). Potential impact includes confidentiality, inte...
CVE-2024-51065
Phpgurukul Beauty Parlour Management System v1.1 is affected by an SQL Injection in admin/index.php via the username parameter, caused by unsafe handling of user input. The CVSSv3.1 metrics indicate a CRITICAL base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with no privileges required, n...
CVE-2024-31972
EnGenius ESR580 A8J-EMR5000 devices allow a remote attacker to conduct stored XSS attacks that could lead to arbitrary JavaScript code execution under the context of the user's session via the Wi-Fi SSID input fields. Web scripts embedded into the vulnerable fields this way are executed immediate...
CVE-2024-31972
CVE-2024-31972 affects EnGenius ESR580 A8J-EMR5000 devices, enabling a remote attacker to perform stored XSS via the Wi‑Fi SSID input fields. The vulnerability leads to arbitrary JavaScript execution within the user’s admin session when loading the login page, specifically impacting the endpoints...
CVE-2024-31972
EnGenius ESR580 A8J-EMR5000 devices allow a remote attacker to conduct stored XSS attacks that could lead to arbitrary JavaScript code execution under the context of the user's session via the Wi-Fi SSID input fields. Web scripts embedded into the vulnerable fields this way are executed immediate...
CVE-2024-31972
EnGenius ESR580 A8J-EMR5000 devices allow a remote attacker to conduct stored XSS attacks that could lead to arbitrary JavaScript code execution under the context of the user's session via the Wi-Fi SSID input fields. Web scripts embedded into the vulnerable fields this way are executed immediate...
pb-cms 跨站脚本漏洞
pb-cms waterfall content management system is a content management system by LinZhaoguan personal developer. A cross-site scripting vulnerability exists in pb-cms versions prior to 2.0.1, which stems from the component Permission Management Page's file /adminpermissions that can lead to cross-sit...
PT-2024-16305 · Unknown · Linzhaoguan Pb-Cms
Name of the Vulnerable Software and Affected Versions: LinZhaoguan pb-cms versions up to 2.0.1 Description: A problematic issue was found in the Permission Management Page component, affecting the /adminpermissions file. This leads to cross-site scripting, which can be initiated remotely. The iss...
CVE-2024-48356
LyLme Spage =1.6.0 is vulnerable to SQL Injection via /admin/group.php...
CVE-2024-48357
CVE-2024-48357 affects LyLme Spage versions 1.2.0 through 1.6.0. The vulnerability is a SQL injection via /admin/apply.php, with a CVSS v3.1 base score of 9.8 (CRITICAL) and impacts on confidentiality, integrity, and availability. No remediation steps are provided in the supplied documents; explo...