50 matches found
CVE-2025-55734 flaskBlo Authorization Bypass
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, the code checks if the userRole is "admin" only when visiting the /admin page, but not when visiting its subroutes. Specifically, only the file routes/adminPanel.py checks the user role when a user is trying to access the admin page,...
CVE-2022-28422
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php=edit...
CVE-2022-28423
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php=delete...
CVE-2023-3152
A vulnerability classified as critical has been found in SourceCodester Online Discussion Forum Site 1.0. This affects an unknown part of the file admin\posts\viewpost.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to t...
Sql injection
A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0 and classified as critical. This issue affects some unknown processing of the file admin\posts\managepost.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit...
CVE-2023-3143
A vulnerability classified as problematic has been found in SourceCodester Online Discussion Forum Site 1.0. Affected is an unknown function of the file admin\posts\managepost.php. The manipulation of the argument content leads to cross site scripting. It is possible to launch the attack remotely...
PT-2023-23318
Name of the Vulnerable Software and Affected Versions SourceCodester Online Discussion Forum Site version 1.0 Description A problematic issue has been discovered, affecting an unknown function in the file adminpostsmanage post.php. The manipulation of the content argument leads to cross-site...
PT-2023-23328
Name of the Vulnerable Software and Affected Versions SourceCodester Online Discussion Forum Site version 1.0 Description A problematic issue was discovered, affecting an unknown functionality in the file adminpostsmanage post.php. The manipulation of the title argument leads to cross-site...
CVE-2023-3148: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0 and classified as critical. This issue affects some unknown processing of the file admin\posts\managepost.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit...
CVE-2023-3143: Improper Neutralization of Input During Web Page Generation
A vulnerability classified as problematic has been found in SourceCodester Online Discussion Forum Site 1.0. Affected is an unknown function of the file admin\posts\managepost.php. The manipulation of the argument content leads to cross site scripting. It is possible to launch the attack remotely...
PT-2023-23358
Name of the Vulnerable Software and Affected Versions SourceCodester Online Discussion Forum Site version 1.0 Description A critical issue affects the processing of the file adminpostsmanage post.php, where the manipulation of the id argument leads to sql injection. This issue can be initiated...
CVE-2023-3152: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in SourceCodester Online Discussion Forum Site 1.0. This affects an unknown part of the file admin\posts\viewpost.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to t...
CVE-2023-3144: Improper Neutralization of Input During Web Page Generation
A vulnerability classified as problematic was found in SourceCodester Online Discussion Forum Site 1.0. Affected by this vulnerability is an unknown functionality of the file admin\posts\managepost.php. The manipulation of the argument title leads to cross site scripting. The attack can be launch...
AeroCMS 代码问题漏洞
AeroCMS is a content management system from the American company AeroCMS. AeroCMS v0.0.1 version of a security vulnerability, the vulnerability stems from /admin/posts.php?source=editpost there are arbitrary file uploads, an attacker can take advantage of the vulnerability to upload a webshell,...
CVE-2022-1694
The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logged in admin to add, modify or delete banners from the plugin by submitting a form...
Publify 访问控制错误漏洞
Publify is a simple but full-featured web publishing software.An access control error vulnerability exists in versions of Publify prior to 9.2.9, which stems from incorrect access control. An attacker could exploit this vulnerability to allow an unprivileged user to modify/delete an administrator...
CVE-2022-30378
Sourcecodester Simple Social Networking Site v1.0 is vulnerable to SQL Injection via /sns/admin/?page=posts/viewpost&id=...
Simple Social Networking Site SQL注入漏洞
Simple Social Networking Site is a social networking site. Simple Social Networking Site has a security vulnerability that can be exploited by attackers to conduct SQL injection attacks via /sns/admin/?page=posts/viewpost&id=...
Sourcecodester Baby Care System SQL注入漏洞（CNVD-2022-35527）
Sourcecodester Baby Care System is an application of the Sourcecodester community in the United States. Sourcecodester Baby Care System v1.0 contains a SQL injection vulnerability, which originates from the lack of validation of external input SQL statements in the find= parameter of...