CVE-2022-50944

Aero CMS 0.0.1 is affected by a PHP code injection vulnerability. Authenticated attackers can upload PHP files via the image parameter to the admin posts.php endpoint with source=add_post, leading to server-side code execution. The vulnerability exposes high impact on confidentiality, integrity, ...

CVE-2022-50944: Improper Control of Generation of Code

Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious files through the image parameter. Attackers can upload PHP files with embedded code to the admin posts.php endpoint with source=addpost parameter, a...

PT-2025-23433 · Unknown · Chaitak-Gorai Blogbook

Name of the Vulnerable Software and Affected Versions: chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513 Description: A critical vulnerability was found in chaitak-gorai Blogbook. The issue affects an unknown function of the file /admin/posts.php?source=add post, where the...

CVE-2025-5406: Unrestricted Upload of File with Dangerous Type

A vulnerability, which was classified as critical, was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. Affected is an unknown function of the file /admin/posts.php?source=addpost. The manipulation of the argument image leads to unrestricted upload. It is possible t...

CVE-2022-46135

In AeroCms v0.0.1, there is an arbitrary file upload vulnerability at /admin/posts.php?source=editpost , through which we can upload webshell and control the web server...

CVE-2022-46135: Unrestricted Upload of File with Dangerous Type

In AeroCms v0.0.1, there is an arbitrary file upload vulnerability at /admin/posts.php?source=editpost , through which we can upload webshell and control the web server...

CVE-2022-28422

The CVE-2022-28422 entry concerns Baby Care System v1.0, which is vulnerable to a SQL injection in the administrative interface. Specifically, the weakness is exposed via /admin/posts.php&action=edit (per multiple sources, e.g., NVD entries and CNVD/CVE records). The root cause is an injectable S...

CVE-2022-28424: Improper Neutralization of Special Elements used in an SQL Command

Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&find=...

PT-2022-19013

Name of the Vulnerable Software and Affected Versions Baby Care System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the "/admin/posts.php&action=edit" API endpoint. The estimated number of potentially affected devices...

PT-2022-19015

Name of the Vulnerable Software and Affected Versions Baby Care System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the /admin/posts.php&find= endpoint. The estimated number of potentially affected devices worldwide is not...

CVE-2022-28422: Improper Neutralization of Special Elements used in an SQL Command

Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=edit...

PT-2022-19014

Name of the Vulnerable Software and Affected Versions Baby Care System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the "/admin/posts.php&action=delete" endpoint. The action parameter in this endpoint is vulnerable to SQL...

CVE-2022-28423: Improper Neutralization of Special Elements used in an SQL Command

Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=delete...

CVE-2021-46458

Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin/posts.php?source=addpost. This vulnerability can be exploited through a crafted POST request via the posttitle parameter...

Sql injection

Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin/posts.php?source=addpost. This vulnerability can be exploited through a crafted POST request via the posttitle parameter...

CVE-2021-46458

Victor CMS v1.0 contains a SQL injection in the admin/posts.php?source=add_post component. The vulnerability is exploitable via a crafted POST request to post_title, allowing an attacker to inject SQL statements through user input. According to NVD, CVSS metrics show a CVSS‑3.1 base score of 7.5 ...

CVE-2021-46458: Improper Neutralization of Special Elements used in an SQL Command

Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin/posts.php?source=addpost. This vulnerability can be exploited through a crafted POST request via the posttitle parameter...

PT-2022-12717

Name of the Vulnerable Software and Affected Versions Victor CMS version 1.0 Description The issue is related to a SQL injection vulnerability in the admin/posts.php component, specifically when the source parameter is set to add post. This vulnerability can be exploited through a crafted POST...