2734 matches found
PT-2022-18343 · Sourcecodester · Sourcecodester Gym Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Gym Management System affected versions not specified Description: A critical issue has been found in the SourceCodester Gym Management System, affecting an unknown functionality of the file /mygym/admin/login.php. The...
Best Fee Management System SQL注入漏洞
Best Fee Management System is a fee management system by Mayuri K. Individual developer. SourceCodester Best Fee Management System suffers from a SQL injection vulnerability that originates in its adminclass.php component, where the operation of the login function on the parameter username result...
Cross site request forgery (csrf)
The Rename wp-login.php WordPress plugin through 2.6.0 does not have CSRF check in place when updating the secret login URL, which could allow attackers to make a logged in admin change them via a CSRF attack...
Hospital Management System SQL注入漏洞
Hospital Management System HMS is a computer system that helps manage health care-related information and helps health care providers do their jobs efficiently. hospital Management System v1.0 is vulnerable to a SQL injection vulnerability that originates in the adminlogin. A SQL injection issue...
Page Generator Plugin < 1.6.6 - Arbitrary Keywords Deletion/Duplication via CSRF
The plugin does not have CSRF check in place when deleting and duplicating keywords, which could allow attackers to make a logged in admin delete and duplicate arbitrary keywords via CSRF attacks PoC https://example.com/wp-admin/admin.php?page=page-generator-keywords=delete=3...
PT-2022-6303 · Dell Emc · Dell Emc Scg Policy Manager
Name of the Vulnerable Software and Affected Versions: Dell EMC SCG Policy Manager versions 5.10 through 5.12 Description: The issue is related to a Hard-coded Cryptographic Key. An attacker with knowledge of the hard-coded sensitive information could potentially exploit this to login to the syst...
CVE-2022-22485
In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 does not cause the administrator's invalid sign-on count to be incremented on the IBM Spectrum Protect Server. An attacker could exploit this vulnerability using brute force...
CVE-2022-20736
A vulnerability in the web-based management interface of Cisco AppDynamics Controller Software could allow an unauthenticated, remote attacker to access a configuration file and the login page for an administrative console that they would not normally have authorization to access. This...
Old Age Home Management System 1.0 - SQLi Authentication Bypass
Exploit Title: Old Age Home Management System 1.0 - SQLi Authentication Bypass Date: 12/06/2022 Exploit Author: twseptian Vendor Homepage: https://phpgurukul.com/old-age-home-management-system-using-php-and-mysql/ Software Link: https://phpgurukul.com/projects/Old-Age-Home-MS-using-PHP.zip Versio...
PT-2022-3486 · Schneider Electric · Conext Combox
Name of the Vulnerable Software and Affected Versions: Conext ComBox All Versions Description: The issue is related to insufficient restriction of excessive authentication attempts, which could allow a remote attacker to bypass security restrictions using a brute force attack. This is due to the...
CVE-2022-23168
The attacker could get access to the database. The SQL injection is in the username parameter at the login panel: username: admin'--...
WordPress plugin HC Custom WP-Admin URL 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...
CVE-2022-32022
Car Rental Management System v1.0 is vulnerable to SQL Injection via /ip/car-rental-management-system/admin/ajax.php?action=login...
CVE-2022-1589
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector...
CVE-2022-1589
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector...
CVE-2022-1589
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector...
CVE-2022-1589
CVE-2022-1589 affects the WordPress plugin “Change wp-admin login” prior to version 1.1.0. The issue arises from insufficient authorization checks and missing CSRF protection when updating settings, enabling unauthenticated users to modify settings via CSRF vectors. Documented impact is unauthent...
GHSA-P9QW-FH38-X37F OpenCart Cross-site Scripting
OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity encoding. NOTE: this issue exists because of an incomplete fix for CVE-2020-10596. The vendor states "this is not a massive issue as you...
CVE-2022-1838
A vulnerability classified as critical has been found in Home Clean Services Management System 1.0. This affects an unknown part of admin/login.php. The manipulation of the argument username with the input admin%'//AND//SELECT//5383//FROM//SELECTSLEEP5JPeh//AND//'frfq%'='frfq leads to sql...
CVE-2022-1838
A vulnerability classified as critical has been found in Home Clean Services Management System 1.0. This affects an unknown part of admin/login.php. The manipulation of the argument username with the input admin%'//AND//SELECT//5383//FROM//SELECTSLEEP5JPeh//AND//'frfq%'='frfq leads to sql...