PT-2024-20106 · Mailcow · Mailcow

Name of the Vulnerable Software and Affected Versions: mailcow versions 2023-12a and prior Description: The application is vulnerable to a pixel flood attack. Once the payload has been successfully uploaded in the logo, the application becomes slow and unresponsive in the admin page...

mailcow 资源管理错误漏洞

mailcow is a mail server suite. A resource management error vulnerability exists in mailcow that stems from the application slowing down and becoming unresponsive in the administration page once the payload is successfully uploaded in the logo. No details of the vulnerability are provided at this...

Advanced Schedule Posts <= 2.1.8 - Reflected XSS

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins...

CVE-2024-22628

Budget and Expense Tracker System v1.0 is vulnerable to SQL Injection via /expensebudget/admin/?page=reports/budget&datestart=2023-12-28&dateend=...

WordPress plugin Slide Anything Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

PT-2024-15595 · Code Projects · Code-Projects Fighting Cock Information System

Name of the Vulnerable Software and Affected Versions: code-projects Fighting Cock Information System version 1.0 Description: A critical issue affects the processing of the file /admin/pages/edit chicken.php, where the manipulation of the id argument leads to sql injection. The attack can be...

PHPGurukul Hospital Management System SQL Injection Vulnerability

PHPGurukul Hospital Management System is a PHP and MySQL based hospital management system. A SQL injection vulnerability exists in PHPGurukul Hospital Management System version 1.0, which originates from a SQL injection vulnerability in the cpass parameter of the admin/change-password.php page...

Cross site scripting

A Cross Site Scripting XSS vulnerability in GetSimple CMS 3.3.16 exists when using Source Code Mode as a backend user to add articles via the /admin/edit.php page...

CVE-2023-51246

A Cross Site Scripting XSS vulnerability in GetSimple CMS 3.3.16 exists when using Source Code Mode as a backend user to add articles via the /admin/edit.php page...

EventON < 4.4.1 - Reflected Cross-Site Scripting

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open a page containing one of the code below: 2.6.x the cmonth a...

Online College Library System SQL Injection Vulnerability

Online College Library System is an online college library system. A SQL injection vulnerability exists in Online College Library System version 1.0, which originates from a security issue in the /admin/returnadd.php page...

PT-2023-32902 · Unknown · Code-Projects Client Details System

Name of the Vulnerable Software and Affected Versions: code-projects Client Details System version 1.0 Description: A vulnerability was found in the code-projects Client Details System, classified as problematic. It affects an unknown function of the file /admin/update-clients.php. The manipulati...

Weseek GROWI Security Vulnerability

Weseek GROWI is a team collaboration software from Weseek Japan. A security vulnerability exists in Weseek GROWI prior to version 6.0.0, which originates from a stored cross-site scripting XSS vulnerability in the App Settings /admin/app page...

PT-2023-32770 · Unknown · Amazing Little Poll

Name of the Vulnerable Software and Affected Versions: Amazing Little Poll versions 1.3 through 1.4 Description: The issue is a Stored XSS vulnerability that allows a remote attacker to store a malicious JavaScript payload in the "lp admin.php" file using the question and item parameters. This...

CVE-2023-6653

A vulnerability was found in PHPGurukul Teacher Subject Allocation Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/subject.php of the component Create a new Subject. The manipulation of the argument cid leads to...

CVE-2023-48940

A stored cross-site scripting XSS vulnerability in /admin.php of DaiCuo v2.5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2023-48940

A stored cross-site scripting XSS vulnerability in /admin.php of DaiCuo v2.5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

DaiCuo Security Breach

DaiCuo DaiCuo is China's DaiCuo DaiCuo company based on ThinkPHP, Bootstrap, Jquery, an adaptive backend management framework. A security vulnerability exists in DaiCuo v2.5.15, which stems from a stored cross-site scripting XSS vulnerability in the file /admin.php. An attacker can exploit this...

Sql injection

Restaurant Table Booking System V1.0 is vulnerable to SQL Injection in rtbs/admin/index.php via the username parameter...

CVE-2023-48881

A stored cross-site scripting XSS vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at /login.php?m=admin&c=Field&a=arctypeadd&ajax=1&lang=cn...