5126 matches found
Shopify: Inject page in admin panel via Shopify.API.pushState
Summary Shopify.API.pushState call the method handleRoutePushEvent, allows you to change routes to open pages from admin panel: js handleRoutePushEventpathname: e, search: t, state: a, hash: o const adminPath: n, history: i = this.props // adminPath = /admin , s = "".concatn.concate; // // If we...
Cross site request forgery (csrf)
Xavier PHP Management Panel 3.0 is vulnerable to Reflected POST-based XSS via the username parameter when registering a new user at admin/includes/adminprocess.php. If there is an error when registering the user, the unsanitized username will reflect via the error page. Due to the lack of CSRF...
OECMS Cross-Site Request Forgery Vulnerability
OECMS is an enterprise web content management system CMS. A cross-site request forgery vulnerability exists in the admincp.php file in OECMS. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker could use this...
Uber: Unsecured Dropwizard Admin Panel on display.uber-adsystem.com exposes sensitive server information
The dropwizard instance running on display.uber-adsystem.com is unsecured, meaning any unauthenticated user can view and use it's admin tools. These tools expose sensitive information on Uber production servers, including the current threads running, info on the CPU, and more server info that...
Sql injection
Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=uiset&m=admin&c=index&a=dogettextcontent&table=lang&field=1 request...
Magento Administration Panel Login Form Detected
Magento Administration Panel has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative functionality. No...
U.S. Dept Of Defense: [██████████] Unauthorized access to admin panel
In previous reports, I described vulnerabilities in a panel to which I had access. 512269 512693 512695 I could log in to this site and then perform some attacks, such as SQL injection\XSS or other bugs. But before the above vulnerabilities were considered by you, the possibility to bypass...
CVE-2019-13029
Multiple stored Cross-site scripting XSS issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to inject arbitrary malicious HTML or JavaScript code into a user's web browser...
CVE-2019-13029
Multiple stored Cross-site scripting XSS issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to inject arbitrary malicious HTML or JavaScript code into a user's web browser...
Cross site scripting
Multiple stored Cross-site scripting XSS issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to inject arbitrary malicious HTML or JavaScript code into a user's web browser...
CVE-2019-13029
Multiple stored Cross-site scripting XSS issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to inject arbitrary malicious HTML or JavaScript code into a user's web browser...
CVE-2019-13029
CVE-2019-13029 describes multiple stored XSS flaws in REDCap’s admin panel and survey system, affecting REDCap 8 prior to 8.10.20 and REDCap 9 prior to 9.1.2. The vulnerability allows an attacker with admin privileges to inject arbitrary HTML/JavaScript into a user’s browser, with the project nam...
CVE-2018-12250
An issue was discovered in Elite CMS Pro 2.01. In /admin/addsidebar.php, the ?page= parameter is vulnerable to SQL injection...
Product update: Virtuozzo Infrastructure Platform 2.5 Update 8 (2.5.0-1680)
This update enables upgrade to the new major version 3.0 and provides important system fixes. Vulnerability id: VSTOR-23308 Journald could get stuck, waiting endlessly for "--verify" to complete and stalling services in an unresponsive state. Vulnerability id: VSTOR-23898 Under certain...
Magento Cross-Site Scripting Vulnerability (CNVD-2019-26215)
Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A cross-site scripting vulnerability exists in the admin panel in Magento Open Source versions prior to 1.9.4.2 a...
Magento cross-site scripting vulnerability (CNVD-2019-26221)
Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A cross-site scripting vulnerability exists in the admin panel in Magento Open Source versions prior to 1.9.4.2 a...
Magento cross-site scripting vulnerability (CNVD-2019-26240)
Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A cross-site scripting vulnerability exists in the admin panel in Magento versions 2.1.18 before 2.1, 2.2.9 befor...
Magento cross-site scripting vulnerability (CNVD-2019-26239)
Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions . A cross-site scripting vulnerability exists in the admin panel in Magento Open Source versions prior to 1.9.4.2...
Quadbase Systems EspressReport ES Cross-Site Request Forgery Vulnerability
Quadbase Systems EspressReport ES ERES is a centralized business intelligence reporting solution from Quadbase Systems, USA. A cross-site request forgery vulnerability in the admin panel in Quadbase Systems ERES v7.0 update 7 can be exploited by an attacker to send an unintended request to the...
