CVE-2021-27730: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Accellion FTA 912432 and earlier is affected by argument injection via a crafted POST request to an admin endpoint. The fixed version is FTA912444 and later...

PT-2021-9641 · Phpgacl · Phpgacl

Name of the Vulnerable Software and Affected Versions: phpGACL version 3.3.7 Description: A SQL injection issue exists, allowing an attacker to send a specially crafted HTTP request to trigger the issue in admin/edit group.php. When the POST parameter action is “Submit”, the POST parameter parent...

TP-Link TL-WPA4220 Arbitrary OS Command Execution Vulnerability

The TP-Link TL-WPA4220 is a 300Mbps AV600 Wi-Fi powerline extender. An arbitrary OS command execution vulnerability exists in httpd in the TP-Link TL-WPA4220. A remote authenticated user can exploit this vulnerability to execute arbitrary OS commands by sending a specially crafted POST request to...

PyroCMS Cross-Site Request Forgery Vulnerability (CNVD-2020-60830)

PyroCMS is an easy-to-use, powerful and modular CMS and development platform built using Laravel 5. A cross-site request forgery vulnerability exists in PyroCMS 3.7. An attacker can exploit this vulnerability by deleting pages via the admin/pages/delete/ URI...

PT-2020-16103

Name of the Vulnerable Software and Affected Versions Sourcecodester Simple Library Management System version 1.0 Description The issue is related to Incorrect Access Control, which can be exploited via the Login Panel. The vulnerable endpoint is "http:///lms/admin.php". Recommendations For...

PT-2020-12067 · Chadha · Chadha Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue concerns the handling of URIs in admin/header.php, which allows for Reflected XSS attacks. This can be exploited in admin/add-news.php by adding a question mark ? followed ...

PT-2020-12113 · Chadha · Chadha Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue concerns how URIs are handled in admin/header.php, allowing for Reflected XSS in admin/report-article-printed.php. This can be achieved by adding a question mark ? followed...

PT-2020-12168 · Chadha · Chadha Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue allows attackers to edit a category, given the id, via a crafted request to the "admin/edit-category.php" endpoint. This is made possible by a CSRF weakness in the software...

PT-2020-12161 · Chadha · Chadha Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue allows attackers to add a department via a crafted request to the admin/manage-departments.php endpoint. This is made possible by a CSRF weakness. Recommendations: For Chad...

PT-2020-12121 · Chadha · Chadha Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue concerns the handling of URIs in admin/header.php, which allows for Reflected XSS attacks. This can be exploited in admin/report-user.php by adding a question mark ? follow...

PT-2020-12169 · Chadha · Chadha Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue allows attackers to close any ticket, given the id, via a crafted request to the "admin/manage-tickets.php" endpoint. This is made possible by a CSRF flaw. Recommendations:...

PT-2020-12165 · Chadha · Chadha Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue allows attackers to edit an article template, given the id, via a crafted request to the "admin/edit-template.php" endpoint. This is made possible by a CSRF weakness...

CVE-2020-7048

The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the database to the initial WordPress set-up state deleting all site content stored in that table, as demonstrated by a wp-admin/admin-post.php?db-reset-tables=comments...

CVE-2020-5512

Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal...

Mail.ru: unauthorized access to add admin endpoint

Access to static page within media-poll.mail.ru admin interface was not restricted. Access to static page does not grant attacker the ability to perform any actions or access any sensitive information...

PT-2019-7396 · WordPress · Dynamic Widgets

Name of the Vulnerable Software and Affected Versions: dynamic-widgets plugin versions prior to 1.5.11 Description: The issue concerns a CSRF with resultant XSS. It is exploitable via the "page limit" parameter in the "/wp-admin/themes.php?page=dynwid-config" API endpoint. Recommendations: For...

CVE-2019-16702

Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs parameter to the /LoginAdmin URI...

PT-2019-14523 · 10Web · 10Web Photo Gallery

Name of the Vulnerable Software and Affected Versions: 10Web Photo Gallery plugin versions prior to 1.5.35 Description: A SQL injection issue exists in the photo-gallery plugin for WordPress. The issue is exploitable via the album id parameter in the admin/controllers/Albumsgalleries.php file...

PT-2019-13779 · WordPress · Import-Users-From-Csv-With-Meta

Name of the Vulnerable Software and Affected Versions: Import users from CSV with meta plugin versions prior to 1.14.2.2 Description: The issue allows for a CSRF attack via the "wp-admin/admin-ajax.php?action=acui delete attachment" API endpoint. This affects the "Import users from CSV with meta"...

PT-2019-13626 · Unknown · Schben Adive

Name of the Vulnerable Software and Affected Versions: Schben Adive version 2.0.7 Description: The issue allows remote unprivileged users, such as editors or developers, to create an administrator account. This can be achieved via the admin/user/add endpoint, as demonstrated by a Python...