CVE-2024-41958-PoC

CVE-2024-41958-PoC This is a small proof of concept for CVE-2024-41958. It is possible to bypass the TFA authentication on the admin panel. Affected versions: 2024-07 Prerequisites needed for the CVE to function: Password and username for an account without TFA. Password and username for an accou...

CVE-2022-31269

CVE : CVE-2022-31269 Exploit Title: Nortek Linear eMerge E3-Series - Information Disclosure leads to access admin dashboard...

Admin-Scanner

Admin-Scanner Website Admin Panel Finder How To Install? Linux/pc sudo apt install python3 sudo apt install python3-pip sudo apt install git git clone https://github.com/alienwhatever/Admin-Scanner.git cd Admin-Scanner How to Install? Termux/Android pkg update && pkg upgrade pkg install python3 p...

CVE-2021-39512-BigTreeCMS-v4.4.14-AccountTakeOver

BigTreeCMS-v4.4.14-Unauthenticated-CSRF-AccountTakeOver Unauthenticated CSRF Account TakeOver in BigTreeCMS v4.4.14 All searchable modules in the admin panel of BigTreeCMS v4.4.14 are vulnerable to reflected DOM-XSS via the URI. Search queries are reflected on the page without proper sanitization...

CVE-2022-36432

CVE-2022-36432 Cross-site Scripting XSS in Preview functionality in Amasty Blog Pro for Magento 2 Description The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks on admin panel users by...

CVE-2022-36433

CVE-2022-36433 Cross-site Scripting XSS en la funcionalidad de creación de publicaciones de blog en Amasty Blog Pro para Magento 2 Descripción La funcionalidad de creación de publicaciones de blog en el plugin Amasty Blog Pro 2.10.3 para Magento 2 permite la inyección de código JavaScript en los...

CVE-2022-35501

CVE-2022-35501 Stored Cross-site Scripting XSS in blog-post creation functionality in Amasty Blog Pro for Magento 2 Description The post creation functionality in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 allows injection of JavaScript code in the title field, leading to XSS...

CVE-2022-42176

PCSecure V5.0.8.xw - Use of Hard-coded Credentials in configuration files leads to admin panel access Summary Vendor: PCTechSoft SAS Product: PCSecure Affected versions: 5.0.8.xw CodeName: PapiQuieroPollo00 Vulnerability Type: Use of Hard-coded Credentials CWE-798 CVSSv3.1 Vector:...

CVE-2021-43032

CVE-2021-43032 In XenForo ≤ 2.2.7, a threat actor with access to the admin panel can save cross-site scripting payloads in any function within the application that accepts HTML code. A payload placed within the 'Advertising' functionality will execute globally on the client side, allowing for...

Triofox - Improper Access Control

The Gladinet Triofox solution before 12.91.1126.65588 and CentreStack before 12.10.595.65696 allow unauthenticated access to the /management/admindatabase.aspx endpoint, exposing sensitive database management functionality to anyone with network access. An unauthenticated attacker can remotely...

Admin-Panel_Finder

Admin Panel Finder A burp suite extension that enumerates infrastructure and application Admin Interfaces. OWASP References: Classification : Web Application Security Testing 02-Configuration and Deployment Management Testing OTG v4 : OWASP OTG-CONFIG-005 WSTG : WSTG-CONF-05 Why should I use this...

CVE-2026-54477

CVE-2026-54477: Admin Panel Missing Security Headers clickjacking / XSS Advisory Field| Value ---|--- CVE| CVE-2026-54477 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.4 Medium Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Vector 4.0|...

Etherpad Lite <1.6.4 - Admin Authentication Bypass

Etherpad Lite before 1.6.4 is exploitable for admin access. id: CVE-2018-9845 info: name: Etherpad Lite 1.6.4 - Admin Authentication Bypass author: philippedelteil severity: critical description: Etherpad Lite before 1.6.4 is exploitable for admin access. impact: | An attacker can bypass the admi...

KevinLAB BEMS (Building Energy Management System) - Backdoor Account

KevinLAB BEMS has an undocumented backdoor account, and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution through the RMI. An attacker could exploit this vulnerability by logging in using the backdoor account with highes...

Sidekiq < 7.0.8 - Cross-Site Scripting

An XSS vulnerability on a Sidekiq admin panel can pose serious risks to the security and functionality of the system. id: CVE-2023-1892 info: name: Sidekiq 7.0.8 - Cross-Site Scripting author: ritikchaddha,princechaddha severity: critical description: | An XSS vulnerability on a Sidekiq admin pan...

CVE-2025-29018

CVE-2025-29018 - Internet Banking System 2.0.0 Stored XSS in pagesaddacctype.php Description A Stored Cross-Site Scripting XSS vulnerability exists in Code Astro Internet Banking System 2.0.0 due to unsanitized input in the name parameter in pagesaddacctype.php. Attackers can store malicious...

CVE-2024-45264

CVE-2024-45264 Descripción sugerida Una vulnerabilidad de falsificación de petición en sitios cruzados CSRF en el panel de administración de SkySystem Arfa-CMS anterior a 5.1.3132 permite a atacantes remotos agregar un nuevo administrador, lo que lleva a una escalada de privilegios. Tipo de...

CVE-2023-41508

CVE-2023-41508 CVE-2023-41508 - A hard-coded password in Super Store Finder v3.6 allows attackers to access the administration panel. Vulnerability Type Incorrect Access Control Vendor of Product Super Store Finder Affected Product Code Base Super Store Finder - Affected version 3.6 or below. Fix...

FuguHub-8.4-Authenticated-RCE-CVE-2024-27697

FuguHub 8.4 RCE Autenticado Fuguhub es un software de servidor multimedia en la nube. La versión probada fue la versión Debian en este enlace: https://fuguhub.com/articles/FuguHub-for-Debian Un problema en Real Time Logic LLC FuguHub v.8.4 permite a un atacante local ejecutar código arbitrario...

Pluck-CMS-v4.7.18-Remote-Code-Execution-CVE-2023-50564

CVE-2023-50564 - Pluck CMS v4.7.18 Exploit de Ejecución Remota de Código RCE Descripción Este script explota una vulnerabilidad de Ejecución Remota de Código RCE en Pluck CMS v4.7.18. La vulnerabilidad permite a un usuario malintencionado subir un archivo PHP malicioso al servidor y ejecutarlo,...