getsimplecms 跨站脚本漏洞

getsimplecms is a content management system for individual developers. A cross-site scripting vulnerability exists in getsimplecms, which stems from an XSS vulnerability in the siteURL parameter of the /admin/settings.php page...

CVE-2021-34635

The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the /admin/partials/settings/poll-maker-settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.8...

WordPress 插件 跨站脚本漏洞

WordPress Plugin is an open source application plugin for WordPress. WordPress plugin has a security vulnerability that originates from the mcount parameter in the file Poll - Maker -settings.php via admin partial settings Poll - Maker -settings.php, the Poll Maker WordPress plugin is susceptible...

CVE-2021-0553

In onBindViewHolder of AppSwitchPreference.java, there is a possible bypass of device admin setttings due to unclear UI. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android...

CVE-2021-0553

In onBindViewHolder of AppSwitchPreference.java, there is a possible bypass of device admin setttings due to unclear UI. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android...

CVE-2021-0553

CVE-2021-0553 affects Android 11 (AppSwitchPreference.java, onBindViewHolder). The issue is a possible bypass of device admin settings caused by an unclear UI, enabling local privilege escalation with user execution privileges required. Exploitation reportedly requires user interaction. The provi...

Arbitrary code execution through admin settings - ownCloud

In the administration settings of the filesantivirus app it was possible to execute arbitrary code...

WP Prayer < 1.6.7 - Arbitrary Plugin Settings Update via CSRF

The plugin did not properly check for CSRF in some of its module functions, allowing attacker to make logged in admin change all plugin's settings including the email settings for example. v1.6.6 fixed most of CSRF checks, but the one in model.emailsettings.php was improperly fixed bypass still...

PUB-A-169936038

In onBindViewHolder of AppSwitchPreference.java, there is a possible bypass of device admin setttings due to unclear UI. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation...

Cookie Law Bar <= 1.2.1 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not properly sanitise its Bar Message setting, allowing high privilege users to set an XSS payload in it, which will be triggered in all frontend page of the blog. As admin, go the plugin settings /wp-admin/options-general.php?page=clb and set a payload such as alert/XSS/ in the B...

CVE-2020-29444

Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting Vulnerability in admin global setting parameters...

Atlassian Confluence Server 跨站脚本漏洞

Atlassian Confluence Server is the server version of Atlassian Australia's suite of collaboration software with enterprise knowledge management capabilities and support for building enterprise WiKi. A cross-site scripting vulnerability exists in Confluence Server versions prior to 7.11.0 that...

CVE-2020-18889

Cross Site Request Forgery CSRF vulnerability in puppyCMS v5.1 that can change the admin's password via /admin/settings.php...

puppyCMS 跨站请求伪造漏洞

puppyCMS is a very simple, flat file CMS. A cross-site request forgery vulnerability exists in puppyCMS version 5.1. The vulnerability can be exploited to change the administrator password via /admin/settings.php...

CVE-2021-21982

VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass vulnerability that may allow a malicious actor with network access to the administrative interface of the VMware Carbon Black Cloud Workload appliance to obtain a valid authentication token. Successful...

CVE-2020-19626

Cross Site Scripting XSS vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new...

Andris Sevcenko craftcms 跨站脚本漏洞

Craft CMS is a content management system for developers, designers and web professionals that provides flexibility, power and ease of use. A cross-site scripting vulnerability exists in Craft CMS version 3.1.31. A remote attacker can inject arbitrary web script or HTML via /admin/settings/sites/n...

CVE-2021-27233

An issue was discovered in Mutare Voice EVM 3.x before 3.3.8. On the admin portal of the web application, password information for external systems is visible in cleartext. The Settings.asp page is affected by this issue...

Pixelimity 跨站请求伪造漏洞

Pixelimity is a PHP-based open source CMS Content Management System. A cross-site request forgery vulnerability exists in Pixelimity version 1.0, which originates from the admin setting.php data Password parameter. No details of the vulnerability are available at this time...

CVE-2020-10478

CSRF in admin/manage-settings.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to change the global settings, potentially gaining code execution or causing a denial of service, via a crafted request...