3093 matches found
Design/Logic Flaw
ED01-CMS v20180505 was discovered to contain an arbitrary file upload vulnerability via /admin/users.php?source=edituser&id=1...
CVE-2022-29418
CVE-2022-29418 affects the WordPress plugin Night Mode (Mark Daniels Night Mode) at versions
CVE-2022-29418
Authenticated admin user role Persistent Cross-Site Scripting XSS in Mark Daniels Night Mode plugin = 1.0.0 on WordPress via vulnerable parameters: &ntmodepagesettingenable-me, &ntmodepagesettingbg-color, &ntmodepagesettingtxt-color, &ntmodepagesettinganccolor...
CVE-2022-29418: Improper Neutralization of Input During Web Page Generation
Authenticated admin user role Persistent Cross-Site Scripting XSS in Mark Daniels Night Mode plugin = 1.0.0 on WordPress via vulnerable parameters: &ntmodepagesettingenable-me, &ntmodepagesettingbg-color, &ntmodepagesettingtxt-color, &ntmodepagesettinganccolor...
Sourcecodester Baby Care System SQL注入漏洞
Sourcecodester Baby Care System is an application of the Sourcecodester community in the United States. Sourcecodester Baby Care System v1.0 contains a SQL injection vulnerability that originates in /admin/uesrs.php & action=type & userrole=Admin & userid= where the userid parameter lacks...
CVE-2022-0661: Improper Control of Generation of Code
The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user Admin+ to inject arbitrary HTML or javascript even with unfilteredhtml disallowed, leading to a stored cross-site scripting XSS...
CVE-2022-27848: Improper Neutralization of Input During Web Page Generation
Authenticated admin+ user Stored Cross-Site Scripting XSS in Modern Events Calendar Lite WordPress plugin = 6.5.1...
Cisco SD-WAN vManage Software Privilege Escalation (cisco-sa-sdwan-privesc-vman-tEJFpBSL)
According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability. - A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as the root user. The...
CVE-2022-22560
Dell EMC PowerScale OneFS 8.1.x - 9.1.x contain hard coded credentials. This allows a local user with knowledge of the credentials to login as the admin user to the backend ethernet switch of a PowerScale cluster. The attacker can exploit this vulnerability to take the switch offline...
CVE-2022-22560
Dell EMC PowerScale OneFS 8.1.x–9.1.x is affected by a vulnerability due to hard coded credentials that allow a locally authenticated attacker to log in as the admin user to the backend Ethernet switch of a PowerScale cluster, potentially taking the switch offline. Root cause: hard coded credenti...
CVE-2022-27163
CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcmsadminUserseditUser...
CVE-2022-22572
A non-admin user with user management permission can escalate his privilege to admin user via password reset functionality. The vulnerability affects Incapptic Connect version 1.40.1...
PT-2022-10602
Name of the Vulnerable Software and Affected Versions WP-Appbox WordPress plugin versions = 4.3.20 Description The issue is related to an Authenticated Stored Cross-Site Scripting XSS in the WP-Appbox WordPress plugin. This allows an attacker with admin user role privileges to inject malicious...
CVE-2021-36910: Improper Neutralization of Input During Web Page Generation
Authenticated admin user role Stored Cross-Site Scripting XSS in WP-Appbox WordPress plugin = 4.3.20...
CVE-2022-28223
Tekon KIO devices through 2022-03-30 allow an authenticated admin user to escalate privileges to root by uploading a malicious Lua plugin...
CVE-2021-44310
An issue was discovered in Firmware Analysis and Comparison Tool v3.2. With administrator privileges, the attacker could perform stored XSS attacks by inserting JavaScript and HTML code in user creation functionality...
Non Privilege User can Enable or Disable Registered
Vulnerability Type Insecure Direct Object Reference Affected URL https://localhost/openemr-6.0.0/interface/modules/zendmodules/public/Installer/manage Affected Parameters “modAction=enabled” Authentication Required? Yes Issue Summary Non-privilege users accounting & front-office can disable and...
Cross-site Scripting in Pimcore Datahub
Pimcore Datahub prior to 1.2.4 is vulnerable to stored cross-site scripting. An admin user accessing Datahub triggers the attack, which may result in the user's cookie being stolen...
ImpressCMS 1.4.2 SQL Injection Vulnerability
--------------------------------------------------------------- ImpressCMS getUserCountByGroupLink@$POST"groups", $criteria; 282. 283. $validsort = array"uname", "email", "lastlogin", "userregdate", "posts"; 284. $sort = !inarray$POST'usersort', $validsort ? "uname" : $POST'usersort'; 285. $order...