3093 matches found
PT-2022-21297
Name of the Vulnerable Software and Affected Versions Prison Management System version 1.0 Description The issue is related to a SQL injection vulnerability. It occurs via the id parameter at the "/pms/admin/user/manage user.php" endpoint. Recommendations For Prison Management System version 1.0,...
CVE-2022-33049
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/?page=user/manageuser...
CVE-2022-1895
The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack...
CVE-2022-32341
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/?page=user/manageuser&id=...
Design/Logic Flaw
A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The application does not perform the integrity check of the update packages. Without validation, an admin user might be tricked to install a malicious package, granting root privileges to an attacker...
CVE-2022-32252
A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The application does not perform the integrity check of the update packages. Without validation, an admin user might be tricked to install a malicious package, granting root privileges to an attacker...
CVE-2022-32252
A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The application does not perform the integrity check of the update packages. Without validation, an admin user might be tricked to install a malicious package, granting root privileges to an attacker...
CVE-2022-1335
The Slideshow CK WordPress plugin before 1.4.10 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfilteredhtml is disallowed...
Privilege escalation
Dell SupportAssist Client Consumer versions 3.11.0 and versions prior and Dell SupportAssist Client Commercial versions 3.2.0 and versions prior contain a privilege escalation vulnerability. A non-admin user can exploit the vulnerability and gain admin access to the system...
CVE-2022-29093
Dell SupportAssist Client Consumer versions 3.10.4 and versions prior and Dell SupportAssist Client Commercial versions 3.1.1 and versions prior contain an arbitrary file deletion vulnerability. Authenticated non-admin user could exploit the issue and delete arbitrary files on the system...
CVE-2022-29092
Dell SupportAssist Client Consumer versions 3.11.0 and versions prior and Dell SupportAssist Client Commercial versions 3.2.0 and versions prior contain a privilege escalation vulnerability. A non-admin user can exploit the vulnerability and gain admin access to the system...
PT-2022-19411
Name of the Vulnerable Software and Affected Versions Dell SupportAssist Client Consumer versions 3.10.4 and earlier Dell SupportAssist Client Commercial versions 3.1.1 and earlier Description The issue allows an authenticated non-admin user to delete or overwrite arbitrary files on the system...
CVE-2022-29094: Improper Limitation of a Pathname to a Restricted Directory
Dell SupportAssist Client Consumer versions 3.10.4 and versions prior and Dell SupportAssist Client Commercial versions 3.1.1 and versions prior contain an arbitrary file deletion/overwrite vulnerability. Authenticated non-admin user could exploit the issue and delete or overwrite arbitrary files...
CVE-2022-29092: Uncontrolled Search Path Element
Dell SupportAssist Client Consumer versions 3.11.0 and versions prior and Dell SupportAssist Client Commercial versions 3.2.0 and versions prior contain a privilege escalation vulnerability. A non-admin user can exploit the vulnerability and gain admin access to the system...
CVE-2022-29093: Improper Limitation of a Pathname to a Restricted Directory
Dell SupportAssist Client Consumer versions 3.10.4 and versions prior and Dell SupportAssist Client Commercial versions 3.1.1 and versions prior contain an arbitrary file deletion vulnerability. Authenticated non-admin user could exploit the issue and delete arbitrary files on the system...
Relative path traversal vulnerability in CLI
...
CVE-2022-1684: Improper Neutralization of Special Elements used in an SQL Command
The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injections exploitable by high privileged users such as admin...
CVE-2022-31989
Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=user/manageuser&id=...