Pickup | Delivery | Dine-in date time <= 1.0.9 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Go to this page:...

CVE-2023-0157

The All-In-One Security AIOS WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user admin+ to plant bogus log files containing malicious JavaScript code that will be executed in the context of any...

CVE-2023-0157

The CVE-2023-0157 entry concerns All-In-One Security (AIOS) for WordPress, where versions prior to 5.1.5 fail to escape log file content before rendering on the plugin’s admin page. This enables an authorized admin+ user to plant log files containing malicious JavaScript that executes in the cont...

Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSS

The plugin does not sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open a page with the code below ' /...

PT-2023-16046 · WordPress · All-In-One Security

Name of the Vulnerable Software and Affected Versions: All-In-One Security AIOS WordPress plugin versions prior to 5.1.5 Description: The issue allows an authorized user with admin+ privileges to plant bogus log files containing malicious JavaScript code. This code will be executed in the context...

The vulnerability of the admin.html page of the P5E GNSS satellite receiver’s microprogramming software allows a hacker to bypass the administrator password.

The vulnerability of the admin.html page of the P5E GNSS satellite receiver’s microprogrammed software is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to remotely compromise the administrator’s password...

Best online news portal SQL注入漏洞

Best online news portal is an online news portal by Mayuri K. Individual developer. SourceCodester Best Online News Portal version 1.0 suffers from a SQL injection vulnerability that stems from a problem in the file /admin/forgot-password.php, where manipulation of the parameter username can lead...

Online Computer and Laptop Store SQL注入漏洞

Online Computer and Laptop Store is an online computer and laptop store from Carlo Montero's personal developer. Online Computer and Laptop Store v1.0 is vulnerable to SQL injection. The vulnerability stems from the lack of validation of external input SQL statements in the parameter id of the fi...

PT-2023-17374 · Unknown · Sourcecodester Online Computer/Laptop Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Computer and Laptop Store version 1.0 Description: A problematic issue has been found, affecting an unknown function of the file "/admin/?page=system info". The manipulation of the System Name argument leads to cross-sit...

Online Computer and Laptop Store 代码问题漏洞

Online Computer and Laptop Store is an online computer and laptop store from Carlo Montero's personal developer. Online Computer and Laptop Store v1.0 contains an arbitrary file upload vulnerability, which stems from the lack of valid validation of uploaded files in file/admin/?page=user, and can...

PT-2023-17358 · Unknown · Sourcecodester Online Computer/Laptop Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Computer and Laptop Store version 1.0 Description: A critical issue has been found in the Avatar Handler component, specifically affecting an unknown functionality of the file /admin/?page=user. This issue leads to...

CVE-2023-26856

Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/ajax.php?action=login...

Online Payroll System 跨站脚本漏洞

Online Payroll System is a system for distributing payroll online. A cross-site scripting vulnerability exists in Online Payroll System. The vulnerability stems from the lack of effective filtering and escaping of user-supplied data in /admin/employeeedit.php, which can be exploited to execute...

PT-2023-17288 · Unknown · Sourcecodester Online Computer/Laptop Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Computer and Laptop Store version 1.0 Description: A vulnerability was found in the software, classified as problematic. It affects some unknown functionality of the file "/admin/?page=product/manage product&id=2". The...

Online Payroll System 跨站脚本漏洞

Online Payroll System is a system for distributing payroll online. A cross-site scripting vulnerability exists in Online Payroll System. The vulnerability stems from the lack of effective filtering and escaping of user-supplied data in /admin/employeeadd.php, which can be exploited to execute...

Ajax Search Lite < 4.11.1, Pro < 4.26.2 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in a response of an AJAX action, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open a page with the code below...

CVE-2023-1466

A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0. It has been rated as critical. This issue affects the function viewstudent of the file admin/?page=students/viewstudent. The manipulation of the argument id with the input 3' AND SELECT 2100 FROM...

CVE-2023-1113

A vulnerability was found in SourceCodester Simple Payroll System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file admin/?page=admin of the component POST Parameter Handler. The manipulation of the argument fullname leads to cross si...

PT-2023-16764 · Sourcecodester · Simple Payroll System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Payroll System version 1.0 Description: A vulnerability was found in the Simple Payroll System, affecting an unknown functionality of the file admin/?page=admin, specifically the POST Parameter Handler component. The...

Music Gallery Site SQL注入漏洞

Music Gallery Site is a music gallery site by Carlo Montero's personal developer. A SQL injection vulnerability exists in SourceCodester Music Gallery Site version 1.0, which originates from a security issue with certain unknown functions in the file /admin/?page=user/manage, resulting in a sql...