PT-2024-23646 · Netentsec · Netentsec Ns-Asg

Name of the Vulnerable Software and Affected Versions: netentsec NS-ASG version 6.3 Description: The issue is related to SQL Injection. It can be exploited via the "/admin/add getlogin.php" API endpoint. Recommendations: For netentsec NS-ASG version 6.3, consider restricting access to the...

PT-2024-23648 · Netentsec · Netentsec Ns-Asg

Name of the Vulnerable Software and Affected Versions: netentsec NS-ASG version 6.3 Description: The issue is related to SQL Injection, which can be exploited via the "/admin/address interpret.php" API endpoint. There is no information provided about the estimated number of potentially affected...

PT-2024-23337 · Netentsec · Netentsec Ns-Asg Application Security Gateway

Name of the Vulnerable Software and Affected Versions: Netentsec NS-ASG Application Security Gateway version 6.3 Description: A critical vulnerability was found in the Netentsec NS-ASG Application Security Gateway. This issue affects an unknown part of the file /admin/list crl conf. The...

PT-2024-22852 · Sourcecodester · Sourcecodester Php Task Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester PHP Task Management System version 1.0 Description: The issue is related to SQL Injection via the update-admin.php endpoint, specifically through the admin id parameter. This allows for potential exploitation. No information is...

PT-2024-21988 · Unknown · Campcodes Complete Online Beauty Parlor Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Complete Online Beauty Parlor Management System version 1.0 Description: A critical issue was found in the system, affecting an unknown function of the file /admin/edit-services.php. The manipulation of the editid argument leads to...

PT-2024-21181 · Amss++ · Amss++

Name of the Vulnerable Software and Affected Versions: AMSS++ version 4.31 Description: The issue allows SQL injection through the /amssplus/admin/index.php endpoint, in the id parameter. This could enable a remote attacker to send a specially crafted SQL query to the server and retrieve all the...

CVE-2023-52555

In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection...

PT-2024-18699 · Unknown · Mini-Tmall

Name of the Vulnerable Software and Affected Versions: Mini-Tmall versions up to 20231017 Description: A critical issue affects the processing of the file at the endpoint "?r=tmall/admin/user/1/1". The manipulation of the orderBy argument leads to SQL injection. The attack can be initiated...

CVE-2023-52555

The mongo-express application, specifically version 1.0.2 , is vulnerable to Cross-Site Request Forgery (CSRF) due to a lack of CSRF protection on the /admin endpoint. An attacker can exploit this flaw to perform unauthorized actions, such as the deletion of a Collection . Additionally, the packa...

PT-2024-20897 · Unknown · Phpgurukul Zoo Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Zoo Management System version 1.0 Description: The issue allows attackers to run arbitrary SQL commands via the editid parameter in the /zms/admin/changeimage.php API endpoint. This enables attackers to potentially extract or modif...

PT-2024-18347 · Sourcecodester · Sourcecodester Complete File Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Complete File Management System version 1.0 Description: A critical vulnerability has been found in the Admin Login Form component of the file /admin/. The manipulation of the username argument with a specific input leads to SQ...

PT-2024-21055 · Alf.Io · Alf.Io

Name of the Vulnerable Software and Affected Versions: alf.io versions prior to 2.0-Mr-2402 Description: The issue allows organization owners to view the generated API KEY and USERS of other organization owners. This is achieved through the "http://192.168.26.128:8080/admin/api/users/" endpoint,...

PT-2024-14586 · Caddy · Caddy +1

Name of the Vulnerable Software and Affected Versions: caddy-security plugin for Caddy version 1.1.20 Description: The issue allows reflected Cross-site Scripting XSS via a GET request to a URL that contains an XSS payload and begins with either a "/admin" or "/settings/mfa/delete/" substring. Th...

UBUNTU-CVE-2023-50291

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...

PT-2024-20883 · Code Projects · Code-Projects Hotel Managment System

Name of the Vulnerable Software and Affected Versions: Code-projects Hotel Managment System version 1.0 Description: The issue allows SQL Injection via the sid parameter in the "Hotel/admin/show.php?sid=2" endpoint. This means an attacker could potentially inject malicious SQL code by manipulatin...

CVE-2024-22593

FlyCms v1.0 contains a Cross-Site Request Forgery CSRF vulnerability via /system/admin/addgroupsave...

PT-2024-19498 · Flycms · Flycms

Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. It occurs via the "/system/admin/add group save" API endpoint. This allows for potentially unauthorized actions to be performed on behalf of an...

PT-2024-19008 · Pimcore · Pimcore Customer Management Framework

Name of the Vulnerable Software and Affected Versions: Pimcore Customer Management Framework versions prior to 4.0.6 Description: The issue allows an authenticated and unauthorized user to access the list of potential duplicate users and see their data. This occurs because permissions are not...

PT-2023-31752 · S Cms · S-Cms

Name of the Vulnerable Software and Affected Versions: S-CMS version 5.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the A textauth parameter at the "/admin/ajax.php" API endpoint. Recommendations: For S-CMS version 5.0, consider...

PT-2023-31751 · S Cms · S-Cms

Name of the Vulnerable Software and Affected Versions: S-CMS version 5.0 Description: The issue is a SQL injection vulnerability. It occurs via the A productauth parameter at the "/admin/ajax.php" API endpoint. Recommendations: For S-CMS version 5.0, consider restricting access to the...