500 matches found
CVE-2021-32573
The express-cart package through 1.1.10 for Node.js allows Reflected XSS for an admin via a user input field for product options. NOTE: the vendor states that this "would rely on an admin hacking his/her own website...
PT-2021-19788 · Unknown · Express-Cart
Name of the Vulnerable Software and Affected Versions: express-cart versions 1.1.10 and earlier Description: The issue allows Reflected XSS for an admin via a user input field for product options. It is noted that exploitation would rely on an admin hacking their own website. Recommendations: For...
Oracle E-Business Suite 安全漏洞
Oracle E-Business Suite is an extension of the original Application ERP, including ERP Enterprise Resource Planning, HR Human Resource Management, CRM Customer Relationship Management, and so on, a collection of management software, is a seamless integration of a management suite. Oracle Advanced...
UBUNTU-CVE-2021-22202
An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in System hooks through the API...
RockOA 跨站脚本漏洞
RockOA Xinhuo is an open source office OA system. RockOA V1.9.8 suffers from a drudgery script vulnerability, which stems from Because webmain/flow/input/modeemailmAction.php does not filter user input tightly, a remote attacker can send malicious code to the administrator and execute JavaScript...
CXUUCMS Cross-Site Scripting Vulnerability
CxuuCms is an easy-to-use, open source PHP+Mysql based content management system. A cross-site scripting vulnerability exists in CXUUCMS V3. An attacker can exploit this vulnerability to conduct cross-site scripting attacks via the first and third input fields of /public/admin.php...
PT-2020-13862 · Codiad · Codiad
Name of the Vulnerable Software and Affected Versions: Codiad versions 1.7.8 and later Description: A Server-Side Request Forgery SSRF issue was found in the software. It allows a user with admin privileges to use the plugin install feature to make the server request any URL via...
CVE-2020-10499
CSRF in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to close any ticket, given the id, via a crafted request...
CVE-2020-10488
CSRF in admin/manage-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a news article via a crafted request...
FlexNet Publisher 11.12.1 - Cross-Site Request Forgery (Add Local Admin) Vulnerability
Exploit for php platform in category web applications...
Simple Online Hotel Reservation System - Cross-Site Request Forgery (Delete Admin) Vulnerability
Exploit for php platform in category web applications Exploit Title: Simple Online Hotel Reservation System - Cross-Site Request Forgery Delete Admin Exploit Author: Mr Winst0n Author E-mail: [email protected] Vendor Homepage: https://code-projects.org/ Software Link :...
Pluck Cross-Site Request Forgery Vulnerability
Pluck is a content management system CMS developed using the PHP language. A cross-site request forgery vulnerability exists in Pluck version 4.7.9-dev1. A remote attacker can exploit this vulnerability by deleting an image with /admin.php?action=deleteimage&var1= URI...
CVE-2019-3584
Exploitation of Authentication vulnerability in MVision Endpoint in McAfee MVision Endpoint Prior to 1811 Update 1 18.11.31.62 allows authenticated administrator users -- administrators to Remove MVision Endpoint via unspecified vectors...
WordPress Social Pug - Easy Social Share Buttons Plugin Cross-Site Scripting Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL server set up personal blog site.Social Pug-Easy Social Share Buttons Plugin is used in one of the social platform sharing plugin. A cross-site scriptin...
CVE-2018-16633
Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...
Cross site scripting
An XSS issue was discovered in admin/link/editlink?id=5 in YUNUCMS 1.1.5...
zzcms SQL Injection Vulnerability (CNVD-2018-26017)
ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A SQL injection vulnerability exists in the admin/specialadd.php file in ZZCMS version 8.3. A remote attacker can exploit this vulnerability to obtain the current user name of mysql with the help of zxbigclass...
OTCMS cross-site scripting vulnerability (CNVD-2018-19093)
OTCMS is an article-based web content management system CMS. A cross-site scripting vulnerability exists in the admin/users.php file in OTCMS version 3.61, which can be exploited by remote attackers to inject arbitrary web script or HTML with the help of the 'dataTypeCN', 'dataMode' and...