CVE-2024-30870

netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/addressinterpret.php...

PT-2024-10564 · Unknown · Chrisy Tfo Graphviz Plugin

Name of the Vulnerable Software and Affected Versions: chrisy TFO Graphviz Plugin versions up to 1.9 Description: A vulnerability was found in the chrisy TFO Graphviz Plugin, which is classified as problematic. The issue affects the function admin page load/admin page of the file...

PHPGurukul Emergency Ambulance Hiring Portal SQL注入漏洞

Emergency Ambulance Hiring Portal is an emergency ambulance hiring portal. Emergency Ambulance Hiring Portal suffers from a SQL injection vulnerability that originates from a lack of validation of an externally-entered SQL statement for the parameter username in the file /admin/forgot-password.ph...

PT-2024-23653 · Unknown · Phpgurukul Emergency Ambulance Hiring Portal

Name of the Vulnerable Software and Affected Versions: PHPGurukul Emergency Ambulance Hiring Portal version 1.0 Description: A critical issue was found in the Forgot Password Page component, specifically in the /admin/forgot-password.php file. The username argument is vulnerable to sql injection,...

PT-2024-22420 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SEMCMS version 4.8 Description: The issue arises from incorrect access control in the code, specifically where SEMCMS Funtion.php is installed before verifying the admin's validity on the admin page. This occurs because the authentication...

Insurance Management System PHP and MySQL 1.0 - Multiple Stored XSS Vulnerabilities

Exploit Title:Insurance Management System PHP and MySQL 1.0 - Multiple Stored XSS Exploit Author: Hakkı TOKLU Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/16995/insurance-management-system-php-mysql.html Version: 1.0 Tested on: Windows 11 / PHP...

Insurance Management System PHP and MySQL 1.0 - Multiple Stored XSS

Exploit Title:Insurance Management System PHP and MySQL 1.0 - Multiple Stored XSS Date: 2024-02-08 Exploit Author: Hakkı TOKLU Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/16995/insurance-management-system-php-mysql.html Version: 1.0 Tested on:...

Campcodes Complete Online DJ Booking System 跨站脚本漏洞

Campcodes Complete Online DJ Booking System is an online DJ booking system from Campcodes, Inc. A cross-site scripting vulnerability exists in version 1.0 of the Campcodes Complete Online DJ Booking System, which stems from a cross-site scripting vulnerability in the fromdate parameter of the...

PT-2024-22491 · Unknown · Employee Management System

Name of the Vulnerable Software and Affected Versions: Employee Management System version 1.0 Description: The issue allows attackers to run arbitrary SQL commands via the admin id parameter in "update-admin.php". This can potentially lead to unauthorized access and manipulation of database...

Employee Management System SQL Injection Vulnerability

Employee Management System is an employee management system. A SQL injection vulnerability exists in Employee Management System v1.0 that could allow an attacker to run arbitrary SQL commands via the adminid parameter in update-admin.php...

CVE-2024-2594

Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting XSS vulnerability through /amssplus/admin/index.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted URL to an...

AMSS++ Cross-Site Scripting Vulnerability

AMSS++ is a tool for the office administration support system of Amssplus. A cross-site scripting vulnerability exists in AMSS++ version 4.31, which stems from a cross-site scripting vulnerability in multiple parameters on the /amssplus/admin/index.php page...

PT-2024-20998 · Sourcecodester · Sourcecodester Employee Task Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Employee Task Management System version 1.0 Description: A critical issue was found in the SourceCodester Employee Task Management System, affecting some unknown functionality of the file update-admin.php. The manipulation of t...

Pz-LinkCard < 2.5.3 - Reflected XSS

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open a page containing the code below ' /...

BIT-MYBB-2020-19048

Cross Site Scripting XSS in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'...

Exploit for Unrestricted Upload of File with Dangerous Type in Bludit

CVE-2023-34845 Vulnerability POC for CVE-2023-34845 Vulner...

WordPress IDonate Blood Request Management System 1.8.1 Cross Site Scripting Vulnerability

Exploit Title: IDonate – blood request management system XSS in Recaptcha secret key and in Recaptcha Site key 3- Click on save changes. 4- While clicking on the payload text, XSS will trigger. Vulnerable Code: public function idonaterecaptchasecretkeycallback if isset...

CVE-2024-25351

SQL Injection vulnerability in /zms/admin/changeimage.php in PHPGurukul Zoo Management System 1.0 allows attackers to run arbitrary SQL commands via the editid parameter...

Marketing Optimizer <= 20200925 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Description The Marketing Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20200925. This is due to missing or incorrect nonce validation via the admin/main-settings-page.php file. This makes it possible for unauthenticated attackers...

CVE-2024-26450

CVE-2024-26450 affects Piwigo versions prior to 14.2.0. The vulnerability chains a Cross-Site Request Forgery to trigger a Stored XSS payload in an Admin dashboard, enabling remote JavaScript execution and the upload of a PHP file under an administrator profile, which can be used to connect back ...