416 matches found
CVE-2022-38305
AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the component /admin/profile.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...
PT-2022-24355 · Aerocms · Aerocms
Name of the Vulnerable Software and Affected Versions: AeroCMS version 0.0.1 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability in the /admin/profile.php component. Recommendations: For AeroCMS version 0.0.1,...
Advanced School Management System SQL Injection Vulnerability (CNVD-2022-68955)
Advanced School Management System is a school management system developed by Angel Jude Reyes Suarez. v1.0 of Advanced School Management System is vulnerable to SQL injection, which originates from /school/model /getadminprofile.php?myindex=The page lacks validation for external input SQL...
CVE-2022-32381
itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/getadminprofile.php?myindex=...
Advanced School Management System SQL注入漏洞
Advanced School Management System is a school management system developed by Angel Jude Reyes Suarez. v1.0 of Advanced School Management System is vulnerable to SQL injection, which originates from /school/model /getadminprofile.php?myindex=The page lacks validation for external input SQL...
CVE-2022-27478
Victor v1.0 was discovered to contain a remote code execution RCE vulnerability via the component admin/profile.php?section=admin...
CVE-2022-27478
Victor v1.0 was discovered to contain a remote code execution RCE vulnerability via the component admin/profile.php?section=admin...
CVE-2022-27478
Victor v1.0 was discovered to contain a remote code execution RCE vulnerability via the component admin/profile.php?section=admin...
CVE-2022-29020
ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar...
CVE-2022-29020
ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar...
ForestBlog 跨站脚本漏洞
ForestBlog is an application. A personal blog. A security vulnerability exists in ForestBlog that allows admin/profile/save userAvatar XSS during the addition of a user avatar...
CVE-2022-29020
ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar...
CVE-2022-29020: Improper Neutralization of Input During Web Page Generation
ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar...
PT-2022-19368
Name of the Vulnerable Software and Affected Versions ForestBlog through 2022-02-16 Description The issue allows for XSS during the addition of a user avatar. This occurs in the admin/profile/save endpoint, specifically with the userAvatar parameter. The estimated number of potentially affected...
Online Banquet Booking System 1.0 Cross Site Request Forgery
Exploit Title: Online Banquet Booking System - 'change admin credentials' Cross-Site Request Forgery CSRF Date: 04/04/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/online-banquet-booking-system-using-php-and-mysql/ Version: 1.0...
CVE-2021-39348
The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $customprofile parameter found in the /inc/admin/views/backend-user-profile.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in version...
CVE-2021-41916
A Cross-Site Request Forgery CSRF vulnerability in webTareas version 2.4 and earlier allows a remote attacker to create a new administrative profile and add a new user to the new profile. without the victim's knowledge, by enticing an authenticated admin user to visit an attacker's web page...
webTareas 跨站请求伪造漏洞
webTareas is a web-based open source collaboration tool. The product supports features such as project management, bug tracking, content management and meeting management. A security vulnerability exists in webTareas, which can be exploited by an attacker to create a new administrative profile, a...
Bus Pass Management System 1.0 - 'adminname' Stored Cross-Site Scripting (XSS)
Exploit Title: Bus Pass Management System 1.0 - 'adminname' Stored Cross-Site Scripting XSS Date: 2021-09-08 Exploit Author: Emre Aslan Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/wp-content/uploads/2021/07/Bus-Pass-Management-System-Using-PHP-MySQL.zip Version:...