CVE-2023-2279

The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'adminpagedisplay' function. This makes it possible for unauthenticated attackers to delete or change plugin...

CVE-2023-2279 WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_display

The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'adminpagedisplay' function. This makes it possible for unauthenticated attackers to delete or change plugin...

Store DOM XSS in Edit configuration

Description I noticed, your website is very secure. But you overlooked a flaw XSS Proof of Concept 1 .Login vs admin demo account and access admin page. 2 .Create a category titled "test456". 3 .Go to Configuration == Edit configuration. 4 .Change the "URL of your FAQ" data field with the payload...

CVE-2023-37688

Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Admin page...

CVE-2023-37688

Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Admin page...

CVE-2023-37688

Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Admin page...

CVE-2023-37687

Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting XSS vulnerability in the View Request of Nurse Page in the Admin portal...

Sql injection

Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Admin page...

Maid Hiring Management System Cross-Site Scripting Vulnerability

PHPGurukul Maid Hiring Management System is a maid hiring management system from PHPGurukul, USA. A security vulnerability exists in Maid Hiring Management System v1.0, which is caused by a SQL injection vulnerability in the Admin page...

CVE-2023-37683

The CVE-2023-37683 entry concerns Online Nurse Hiring System v1.0 with a cross-site scripting (XSS) vulnerability in the Admin Profile Page. The available connected documents confirm the affected product and the vulnerability class but do not provide a vendor-specific patch version. Some sources ...

CVE-2023-37688

Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Admin page...

PT-2023-26075 · Unknown · Maid Hiring Management System

Name of the Vulnerable Software and Affected Versions: Maid Hiring Management System version 1.0 Description: The issue is related to a SQL injection vulnerability found in the Admin page of the system. Recommendations: For Maid Hiring Management System version 1.0, consider restricting access to...

CVE-2023-37688

Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Admin page...

User Activity Tracking and Log < 4.0.9 - License Update/Deactivation via CSRF

Description The plugin does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks Make a logged in admin open a page with the code below To make them deactivate the license To make th...

Sql injection

emlog v2.1.9 was discovered to contain a SQL injection vulnerability via the component /admin/user.php...

PT-2023-6376 · WordPress · Twittee Text Tweet Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Twittee Text Tweet WordPress plugin versions 1.0.0 through 1.0.8 Description: The issue arises from the plugin's failure to properly escape POST values, which are then printed back to the user inside one of the plugin's administrative pages...

DuxCMS 跨站请求伪造漏洞

DuxCMS is an open source content management system. A cross-site request forgery vulnerability exists in DuxCMS version 2.1, which originates from admin.php that allows remote attackers to modify application data via article/admin/content/add...

PT-2023-27139 · Unknown · Sourcecodester Simple Online Mens Salon Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Online Mens Salon Management System version 1.0 Description: A critical issue has been found, affecting an unknown function of the file "/admin/?page=user/manage user&id=3". The manipulation of the id argument leads to S...

WPCode < 2.0.13.1 - Reflected XSS

Description The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting Make a logged in admin open https://example.com/wp-admin/admin.php?page=wpcode&a"alert/XSS/=2...

CVE-2023-37745

A cross-site scripting XSS vulnerability in Maid Hiring Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page Description of the /admin/aboutus.php component...