alextselegidis/easyappointments Session Fixation vulnerability

alextselegidis/easyappointments is vulnerable to session fixation. The application does not generate a new easession cookie after the user authenticates. A malicious user may create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid,...

SourceCodester Complaint Management System SQL注入漏洞

Complaint Management System is a complaint management system by the individual developer Arvin Arandilla. A SQL injection vulnerability exists in SourceCodester Complaint Management System version 1.0, which stems from a problem in the file /admin/userprofile.php, where manipulation of the...

CVE-2022-45178

An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdeskintegration/saml/user/createorupdate endpoint, the /settings/guest-settings endpoint, the /settings/samlusers-settings endpoint, and the /settings/users-settings endpoint. A...

CVE-2023-28340

Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack...

CVE-2023-28340: Improper Restriction of XML External Entity Reference

Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack...

PT-2023-21404 · Sap · Sap Crm

Name of the Vulnerable Software and Affected Versions: SAP CRM versions 700 through 713 Description: The issue allows an authenticated attacker with a non-administrative role and common remote execution authorization to use a vulnerable interface and execute an application function, performing...

CVE-2023-28340

Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack...

CVE-2023-0423

The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

XXL-JOB vulnerable to Cross-site Scripting

XXL-JOB com.xuxueli:xxl-job versions 2.4.0 and earlier are vulnerable to cross-site scripting XSS. An HTML uploaded payload can be executed successfully through /xxl-job-admin/user/add and /xxl-job-admin/user/update...

CVE-2023-26120

This affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/user/add and /xxl-job-admin/user/update...

CVE-2023-26120: Improper Neutralization of Input During Web Page Generation

This affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/user/add and /xxl-job-admin/user/update...

CVE-2023-0156: Improper Limitation of a Pathname to a Restricted Directory

The All-In-One Security AIOS WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only...

CVE-2023-25031: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin = 2.7.1 versions...

CVE-2023-25049: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin = 3.3.4 versions...

CVE-2023-23996 WordPress ProfilePress Plugin <= 4.5.3 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in ProfilePress Membership Team ProfilePress plugin = 4.5.3 versions...

Employee Task Management System v1.0 - SQL Injection Vulnerability

Exploit Title: Employee Task Management System v1.0 - SQL Injection on task-details.php?taskid=? Exploit Author: Muhammad Navaid Zafar Ansari CVE Assigned: CVE-2023-0904 mitre.org, nvd.nist.org Vendor Homepage: https://www.sourcecodester.com Software Link: Employee Task Management System Version:...

CVE-2023-1740

A vulnerability was found in SourceCodester Air Cargo Management System 1.0. It has been classified as critical. Affected is an unknown function of the file admin/user/manageuser.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible...

Sql injection

A vulnerability was found in SourceCodester Air Cargo Management System 1.0. It has been classified as critical. Affected is an unknown function of the file admin/user/manageuser.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible...

PT-2023-17205 · Sourcecodester · Sourcecodester Garage Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Air Cargo Management System version 1.0 Description: A critical issue was found in the SourceCodester Air Cargo Management System. It affects an unknown function of the file admin/user/manage user.php, specifically the componen...

CVE-2023-1740: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester Air Cargo Management System 1.0. It has been classified as critical. Affected is an unknown function of the file admin/user/manageuser.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible...