938 matches found
CVE-2024-3406
The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Sensitive Information Exposure
RhodeCode and Kallithea is vulnerable to Sensitive Information Exposure. The vulnerability is due to a lack of admin authentication which allows remote users to obtain API keys and other sensitive information via the getrepo API method...
PT-2024-22420 · Semcms · Semcms
Name of the Vulnerable Software and Affected Versions: SEMCMS version 4.8 Description: The issue arises from incorrect access control in the code, specifically where SEMCMS Funtion.php is installed before verifying the admin's validity on the admin page. This occurs because the authentication...
WordPress plugin easy-popup-show 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
CVE-2024-1882 Server-side resource injection in PaperCut NG/MF
This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server...
CVE-2024-27198
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible...
CVE-2024-1586
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom schema in all versions up to, and including, 1.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in ELECOM wireless LAN routers allows a remote unauthenticated attacker to hijack the authentication of administrators and to perform unintended operations to the affected product. Affected products and versions are as follows: WRC-1167GS2-B v1.67 and...
Demososo DM Enterprise Website Building System License Issues Vulnerability
Demososo DM Enterprise Website Building System is a system website of Demososo Inc. An authorization issue vulnerability exists in Demososo DM Enterprise Website Building System version 2022.8 and earlier, which stems from a security issue in the dmlogin function of indexDMload.php in the compone...
CVE-2023-41283 QTS, QuTS hero, QuTScloud
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596...
CVE-2023-48652
Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery CSRF via /ccm/system/dialogs/logs/deleteall/submit. An attacker can force an admin user to delete server report logs on a web application to which they are currently authenticated...
CVE-2023-46355
In the module "CSV Feeds PRO" csvfeeds 2.6.1 from Bl Modules for PrestaShop, a guest can download personal information without restriction. Due to too permissive access control which does not force administrator to use password on feeds, a guest can access exports from the module which can lead t...
CVE-2023-22273
CVE-2023-22273 affects Adobe RoboHelp Server; the path traversal vulnerability in RoboHelp Server versions 11.4 and earlier could allow an admin-authenticated attacker to achieve remote code execution. Public sources confirm the issue as part of APSB23-53 (update to 11 Update 5). The connected do...
CVE-2023-36688
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Michael Mann Simple Site Verify plugin = 1.0.7 versions...
CVE-2023-46199
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Triberr plugin = 4.1.1 versions...
CVE-2023-45832
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Martin Gibson WP GoToWebinar plugin = 14.45 versions...
CVE-2023-45833
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in LeadSquared Suite plugin = 0.7.4 versions...
CVE-2023-45768
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Stephanie Leary Next Page plugin = 1.5.2 versions...