CVE-2025-5922: Insufficiently Protected Credentials

Access to TSplus Remote Access Admin Tool is restricted to administrators unless "Disable UAC" option is enabled and requires a PIN code. In versions below v18.40.6.17 the PIN's hash is stored in a system registry accessible to regular users, making it possible to perform a brute-force attack usi...

TSplus Remote Access Admin Tool security vulnerability

The TSplus Remote Access Admin Tool is a tool for centralized configuration and administration of the TSplus Remote Access Server from TSplus France. A security vulnerability exists in versions prior to TSplus Remote Access Admin Tool v18.40.6.17, which stems from an unsalted PIN hash stored in t...

BIT-MOODLE-2024-34001 moodle: CSRF risk in admin preset tool management of presets

Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk...

CVE-2022-31050

TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This...

CVE-2025-2159: Improper Neutralization of Input During Web Page Generation

Stored XSS in Desktop UI in M-Files Server Admin tool before version 25.3.14681.7 on Windows allows authenticated local user to run scripts via UI...

PT-2025-14853 · M Files · M-Files Server Admin Tool

Name of the Vulnerable Software and Affected Versions: M-Files Server Admin tool versions prior to 25.3.14681.7 Description: The issue concerns a stored XSS in the desktop UI of the M-Files Server Admin tool. This allows authenticated local users to execute scripts through the UI. Recommendations...

CVE-2024-48232

An issue was found in mipjz 5.0.5. In the mipPost method of \app\setting\controller\ApiAdminTool.php, the value of the postAddress parameter is not processed and is directly passed into curlexec execution and output, resulting in a Server-side request forgery SSRF vulnerability that can read serv...

PT-2024-33043 · Mipjz · Mipjz

Name of the Vulnerable Software and Affected Versions: mipjz version 5.0.5 Description: A Server-side request forgery SSRF vulnerability exists due to the improper handling of the postAddress parameter in the mipPost method of the ApiAdminTool.php file. This allows an attacker to read server file...

admin-tool-button (>=1.0.1a0, <=1.0.5a0), apis-ampel (0.1.0) +43 more potentially affected by CVE-2024-45231 via django (3.2.0)

django PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - admin-tool-button =1.0.1a0, =0.2.0, =0.14.0, =0.13.0, =0.8.0, =0.9.16 and more Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

Security Bulletin: Security Vulnerabilities discovered in IBM Security Verify Directory (CVE-2022-32753, CVE-2022-32756, CVE-2022-32754)

Summary Security Vulnerabilities discovered in Web Admin Tool provided by IBM Security Verify Directory products have been resolved. Vulnerability Details CVEID:CVE-2022-32753 DESCRIPTION: IBM Security Verify Directory 10.0.0 uses weaker than expected cryptographic algorithms that could allow an...

CVE-2024-39241

Cross Site Scripting XSS vulnerability in skycaiji 2.8 allows attackers to run arbitrary code via /admin/tool/preview...

PT-2024-28405

Name of the Vulnerable Software and Affected Versions skycaiji version 2.8 Description A Cross Site Scripting XSS issue allows attackers to run arbitrary code via the "/admin/tool/preview" API endpoint. This enables attackers to execute malicious scripts on the affected system. Recommendations Fo...

skycaiji Security Breach

Skycaiji Blue Sky Collector is a free data collection and publishing crawler software from China Nanchang Zhuolan Technology Co., Ltd, developed with php+mysql, and can be deployed on cloud servers. A security vulnerability exists in skycaiji version 2.8, which originates from a cross-site...

CVE-2024-39241

Cross Site Scripting XSS vulnerability in skycaiji 2.8 allows attackers to run arbitrary code via /admin/tool/preview...

CVE-2024-39241: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in skycaiji 2.8 allows attackers to run arbitrary code via /admin/tool/preview...

BIT-OPENCART-2024-21515

This affects versions of the package opencart/opencart from 4.0.0-0. A reflected XSS issue was identified in the filename parameter of the admin tool/log route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login a...

Cross site scripting in opencart

This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the admin tool/log route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login a...

GHSA-QX44-885H-7P56 Cross site scripting in opencart

This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the admin tool/log route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login a...

CVE-2024-21515

CVE-2024-21515 affects opencart/opencart 4.0.0.0+. A reflected XSS in the filename parameter of the admin tool/log route could enable an attacker to trick an admin user into exposing a token, prompting login, and executing a payload after authentication. If the attacker has admin privileges, this...

CVE-2024-21515

This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the admin tool/log route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login a...