CVE-2020-8218

A code injection vulnerability exists in Pulse Connect Secure 9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface...

CVE-2020-18230

Cross Site Scripting XSS in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfgswitchshow" of component " /admin/webconfig.php"...

CVE-2020-8260

A vulnerability in the Pulse Connect Secure 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction...

PT-2025-16371 · Nmap +1 · Nmap +3

Name of the Vulnerable Software and Affected Versions: Extron SMP 111 versions 3.01 and earlier Extron SMP 351 versions 2.16 and earlier Extron SMP 352 versions 2.16 and earlier Description: A command injection issue in the Nmap diagnostic tool within the admin web console allows a remote...

CSV Injection

Overview Affected versions of this package are vulnerable to CSV Injection in the ServiceDBStore when exporting a CSV. Remediation Upgrade org.apache.ranger:security-admin-web to version 2.6.0 or higher. References - Apache Jira Issues - GitHub Commit - GitHub Commit - OSS Security Advisory -...

CVE-2024-47908

OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

VulnCheck KEV: CVE-2024-9644

The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to an authentication bypass vulnerability in the administrative web server. Authentication is not enforced on some administrative functionality when using the "bapply.cgi" endpoint instead of the normal "apply.cgi" endpoint. A remote...

CVE-2024-9644

The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to an authentication bypass vulnerability in the administrative web server. Authentication is not enforced on some administrative functionality when using the "bapply.cgi" endpoint instead of the normal "apply.cgi" endpoint. A remote...

PT-2025-3731

Name of the Vulnerable Software and Affected Versions Four-Faith F3x36 router version 2.0.0 Description The issue is related to authentication bypass due to hard-coded credentials in the administrative web server. An attacker with knowledge of the credentials can gain administrative access via...

Vulnerabilities fixed in Ivanti Cloud Security Appliance

Ivanti has fixed vulnerabilities in the Cloud Security Appliance CSA for versions prior to 5.0.3. The vulnerabilities are located in the admin web console of the Ivanti Cloud Security Appliance. The first vulnerability involves an authentication bypass, allowing remote unauthenticated attackers t...

CVE-2024-11773

SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements...

CVE-2024-11639

The connected sources confirm multiple vulnerabilities in Ivanti Endpoint Manager Cloud Services Appliance (Ivanti CSA) prior to version 5.0.3. Specifically: authentication bypass in the admin web console (CVE-2024-11639) that could grant remote admin access; command injection (CVE-2024-11772) re...

PT-2024-9378 · Ivanti · Ivanti Csa

Name of the Vulnerable Software and Affected Versions: Ivanti CSA versions prior to 5.0.3 Description: The issue is related to an authentication bypass in the admin web console of Ivanti CSA, allowing a remote unauthenticated attacker to gain administrative access. There is no evidence of...

CVE-2024-11492

A vulnerability classified as problematic has been found in 115cms up to 20240807. This affects an unknown part of the file /index.php/admin/web/appurladd.html. The manipulation of the argument tid leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

PT-2024-17029 · 115Cms · 115Cms

Name of the Vulnerable Software and Affected Versions: 115cms up to 20240807 Description: A vulnerability was found in an unknown functionality of the file /index.php/admin/web/set.html. The manipulation of the type argument leads to cross-site scripting. The attack can be launched remotely...

CVE-2024-5917

A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible...

CVE-2024-5917 PAN-OS: Server-Side Request Forgery in WildFire

A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible...

CVE-2024-47943 Improper signature verification of firmware upgrade files

The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices checks if the patch files are signed before executing the containing run.sh script. The signing process is kind of an HMAC with a long string as key which is hard-coded in the...

CVE-2024-47943 Improper signature verification of firmware upgrade files

The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices checks if the patch files are signed before executing the containing run.sh script. The signing process is kind of an HMAC with a long string as key which is hard-coded in the...

PT-2024-32905 · Rittal · Iot Interface & Cmc Iii Processing Unit

Name of the Vulnerable Software and Affected Versions: Rittal IoT Interface & CMC III Processing Unit affected versions not specified Description: The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices checks if the patch files are...