CVE-2024-35009

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/shareswitch.php?mudi=switch&dataType=&fieldName=state&fieldName2=state&tabName=banner&dataID=6...

Web-School ERP 跨站脚本漏洞

Web-School ERP is an application from Web-School India, Inc. An ERP application. A cross-site scripting vulnerability exists in School ERP Pro+Responsive version 1.0, which originates from a cross-site scripting vulnerability in the /schoolerp/officeadmin/ page for the esbankacc, esbankname,...

College Management System SQL注入漏洞

College Management System is a simple project organized by Code Projects. It is used to keep track of students, teachers, subjects, schedules and all things related to the university. A SQL injection vulnerability exists in College Management System version 1.0, which stems from an SQL injection...

Web-School ERP SQL注入漏洞

Web-School ERP is an application from Web-School India. An ERP application. A SQL injection vulnerability exists in Web-School ERP version 1.0, which originates from a SQL injection vulnerability in the groupsid, examname, classesid, esvoucherid, esclass, etc parameters on the...

CVE-2024-2401 Admin Page Spider <= 3.31 - Authenticated (Admin+) Stored Cross-Site Scripting

The Admin Page Spider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permission...

PT-2024-20231 · WordPress · Admin Page Spider

Name of the Vulnerable Software and Affected Versions: Admin Page Spider plugin for WordPress versions up to, and including, 3.20 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticat...

WordPress Admin Page Spider plugin <= 3.31 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Dikshita Trivedi Cybersecdexter in WordPress Plugin Admin Page Spider versions = 3.31...

WordPress Admin Page Spider Plugin <= 3.31 is vulnerable to Cross Site Scripting (XSS)

Software Admin Page Spider Type Plugin Vulnerable versions = 3.31 Fixed in 3.32 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2401 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 19b13ecee07e Credits Dikshita Trivedi...

Admin Page Spider < 3.32 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-31545

Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/?page=user/manageuser&id=6...

CVE-2024-31545

Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/?page=user/manageuser&id=6...

PT-2024-27503 · Unknown · Cym1102 Nginxwebui

Name of the Vulnerable Software and Affected Versions: cym1102 nginxWebUI versions up to 3.9.9 Description: A critical issue affects the function findCountByQuery of the file /adminPage/www/addOver. The manipulation of the argument dir leads to path traversal. This issue can be exploited remotely...

PT-2024-27520 · Unknown · Cym1102 Nginxwebui

Name of the Vulnerable Software and Affected Versions: cym1102 nginxWebUI versions up to 3.9.9 Description: A critical issue has been found in the function exec of the file /adminPage/conf/reload. The manipulation of the argument nginxExe leads to deserialization. The attack may be initiated...

CVE-2024-31986 XWiki Platform CSRF remote code execution through scheduler job's document reference

XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, by creating a document with a special crafted documented reference and an XWiki.SchedulerJobClass XObject, it is possible to execute arbitrary code on the server whenever an...

CVE-2024-31506

Sourcecodester Online Graduate Tracer System v1.0 is vulnerable to SQL Injection via the "id" parameter in admin/admincs.php...

CVE-2024-31506

Sourcecodester Online Graduate Tracer System v1.0 is vulnerable to SQL Injection via the "id" parameter in admin/admincs.php...

CVE-2024-3437

A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /Admin/add-admin.php of the component Avatar Handler. The manipulation of the argument avatar leads to unrestricted upload. The attack ma...

Prison Management System 代码问题漏洞

Prison Management System is a prison management system. A file upload vulnerability exists in Prison Management System version 1.0, which stems from a lack of validation of uploaded files in the avatar parameter of the /Admin/add-admin.php file. This vulnerability can be exploited to remotely...

CVE-2024-3422

CVE-2024-3422 affects SourceCodester Online Courseware 1.0. The vulnerability is an SQL injection in the file admin/activatestud.php caused by unsafely manipulating the selector argument. It can be exploited remotely and has been publicly disclosed (VDB-259594). Several connected sources concur o...

PT-2024-25306 · Sourcecodester · Sourcecodester Aplaya Beach Resort Online Reservation System

Name of the Vulnerable Software and Affected Versions: SourceCodester Aplaya Beach Resort Online Reservation System version 1.0 Description: A critical issue has been found, affecting an unknown function of the file admin/mod users/index.php. The manipulation of the id argument leads to SQL...