2394 matches found
CVE-2023-5826
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/listonlineuser.php. The manipulation of the argument SessionId leads to sql injection. The exploit has been disclosed ...
The vulnerability of the Store Exporter plugin for WooCommerce in the WordPress content management system arises from the lack of protective measures for website structures, allowing attackers to carry out cross-site scripting attacks.
The vulnerability of the Store Exporter plugin for WooCommerce in the WordPress content management system is related to the failure to remove special elements during the processing of the woo-ce admin page. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting...
CVE-2023-46306
The web administration interface in NetModule Router Software NRSW 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 executes an OS command constructed with unsanitized user input: shell metacharacters in the /admin/gnssAutoAlign.php deviceid parameter. This occurs because another thread can be start...
PT-2023-28151 · Unknown · Home Assistant
Name of the Vulnerable Software and Affected Versions: Home Assistant versions prior to 2023.9.0 Description: The Home Assistant login page is affected by a Cross-site Scripting XSS issue. This occurs because the redirect uri validation does not properly check the scheme of URLs, allowing for...
Security Bulletin: The IBM® Engineering Lifecycle Engineering displays sensitive Information on ADMIN page (CVE-2022-34355).
Summary Application displays Sensitive Information related to the backend technologies like JVM, DB Version, Application Server on ADMIN page. Vulnerability Details CVEID:CVE-2022-34355 DESCRIPTION: IBM Jazz Foundation could disclose sensitive version information to a user that could be used in...
CVE-2023-44393 Piwigo Reflected XSS vulnerability
Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting XSS vulnerability is in the /admin.php?page=plugins&tab=new&installstatus=ok&pluginid=here page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS co...
PT-2023-32015 · Ecshop · Ecshop
Name of the Vulnerable Software and Affected Versions: ECshop version 4.1.1 Description: A critical issue has been found in an unknown functionality of the file /admin/order.php. The manipulation of the goods id argument leads to SQL injection. This issue can be exploited remotely. Recommendation...
CVE-2023-44044
Super Store Finder v3.6 and below was discovered to contain a SQL injection vulnerability via the Search parameter at /admin/stores.php...
CVE-2023-44044
Super Store Finder v3.6 and below was discovered to contain a SQL injection vulnerability via the Search parameter at /admin/stores.php...
CVE-2023-44044
Affected product: Super Store Finder v3.6 and below. Vulnerability: SQL injection via the Search parameter in /admin/stores.php. Root cause / detail: As disclosed, the vulnerability allows injection through the Search input, enabling potentially unauthorized data access or modification. Impact (a...
CVE-2023-43457
An issue in Service Provider Management System v.1.0 allows a remote attacker to gain privileges via the ID parameter in the /php-spms/admin/?page=user/ endpoint...
CVE-2023-5017
A vulnerability was found in lmxcms up to 1.41. It has been rated as critical. Affected by this issue is some unknown functionality of the file admin.php. The manipulation of the argument lid leads to sql injection. VDB-239858 is the identifier assigned to this vulnerability. NOTE: The vendor was...
lmxcms SQL Injection Vulnerability
lmxcms dream cms is a website builder from China Dream Cms lmxcms company. SQL injection vulnerability exists in lmxcms version before 1.41, the vulnerability stems from the existence of an unknown function in the file admin.php, which leads to sql injection via the parameter lid...
Store XSS in Mail Setup
Description I noticed, your website is very secure. But you overlooked a flaw XSS . Proof of Concept Detail: 1 .Login vs admin demo account and access admin page. 2 .Go to Configuration == Mail setup. 3 .Insert payload into Password: test"alertdocument.domain 4 .Click save configuration == detect...
CVE-2023-2279
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'adminpagedisplay' function. This makes it possible for unauthenticated attackers to delete or change plugin...
CVE-2023-2279
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'adminpagedisplay' function. This makes it possible for unauthenticated attackers to delete or change plugin...
CVE-2023-2279
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'adminpagedisplay' function. This makes it possible for unauthenticated attackers to delete or change plugin...
CVE-2023-2279 WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_display
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'adminpagedisplay' function. This makes it possible for unauthenticated attackers to delete or change plugin...
Store DOM XSS in Edit configuration
Description I noticed, your website is very secure. But you overlooked a flaw XSS Proof of Concept 1 .Login vs admin demo account and access admin page. 2 .Create a category titled "test456". 3 .Go to Configuration == Edit configuration. 4 .Change the "URL of your FAQ" data field with the payload...