PT-2023-32887 · Code Projects · Automated Voting System

Name of the Vulnerable Software and Affected Versions: code-projects Automated Voting System version 1.0 Description: A critical vulnerability has been found in the Automated Voting System. This issue affects the /admin/ file of the Admin Login component. The manipulation of the username argument...

PT-2023-32879 · Unknown · Code-Projects Library Management System

Name of the Vulnerable Software and Affected Versions: code-projects Library Management System version 2.0 Description: A critical issue was found in the code-projects Library Management System, affecting the file /admin/login.php. The manipulation of the username argument leads to SQL injection...

EazyDocs < 2.3.6 - Subscriber+ Arbitrary Posts Deletion and Document Management

Description The plugin does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from the plugin, allowing any authenticated users, such as subscriber to delete arbitrary posts, as well as add and delete documents/sections. 1. Install the...

CVE-2023-48016

Restaurant Table Booking System V1.0 is vulnerable to SQL Injection in rtbs/admin/index.php via the username parameter...

CVE-2023-48882

A stored cross-site scripting XSS vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Document Properties field at /login.php m=admin&c=Index&a=changeTableVal&ajax=1&lang=cn...

U.S. Dept Of Defense: Default Admin Username and Password on ███

A vulnerability was found where default administrator credentials could be used to access an application. This could have allowed unauthorized access...

There is stored XSS in version 1.6.4 which can lead to stealing sensitive information of logged-in users

Software Link : https://github.com/weng-xianhu/eyoucms Website...

PT-2023-27677 · Unknown · Phpgurukul User Registration & Login/User Management System With Admin Panel

Name of the Vulnerable Software and Affected Versions: Phpgurukul User Registration & Login and User Management System With admin panel version 3.0 Description: The issue allows attackers to obtain sensitive information via a crafted string in the admin user name field on the admin log in page...

Live News < 1.07 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

eClass Junior 4.0 SQL Injection

==================================================================================================================================== | Title : eClass Junior 4.0 Sql injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit | |...

Exploit for Cross-site Scripting in Moosocial

CVE-2023-44812 A reflected cross-site scripting XSS vulnerab...

Who’s Behind the 8Base Ransomware Website?

The victim shaming website operated by the cybercriminals behind 8Base -- currently one of the more active ransomware groups -- was until earlier today leaking quite a bit of information that the crime group probably did not intend to be made public. The leaked data suggests that at least some of...

PT-2023-31499 · Unknown · 07Fly Crm V2

Name of the Vulnerable Software and Affected Versions: 07FLY CRM V2 Description: A critical issue has been found in the Administrator Login Page component, specifically affecting the /index.php/sysmanage/Login/login auth/ file. The manipulation of the account argument leads to SQL injection. This...

SQL Injection Vulnerability in Content Page

In menu Content page, there is a SQL Injection Vulnerability at Filter function. To exploit this vulnerability, attacker injection query into filter field. Proof of Concept 1. Login with admin 2. Go to "http://127.0.0.1/icms2/admin/content/5". In this case, the number 5 is content's id Can be...

CVE-2023-40329

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPZest Custom Admin Login Page | WPZest plugin = 1.2.0 versions...

CVE-2023-40329 WordPress Custom Admin Login Page | WPZest Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPZest Custom Admin Login Page | WPZest plugin = 1.2.0 versions...

CVE-2023-40329

CVE-2023-40329 affects the WordPress plugin WPZest Custom Admin Login Page (WPZest) up to version 1.2.0. The vulnerability is an authenticated Stored Cross-Site Scripting (XSS) flaw, where user input in admin settings is not properly validated/escaped, enabling XSS with admin privileges. Several ...

CVE-2023-40329 WordPress Custom Admin Login Page | WPZest Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPZest Custom Admin Login Page | WPZest plugin = 1.2.0 versions...

WordPress plugin custom-admin-login-styler-wpzest cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

Store XSS in Widgets and pages

Description I noticed that you filtered the comment very carefully. But there are still some parts you missed Proof of Concept 1 .Login with admin 2 .Go to "https://demo.instantcms.io/admin/widgets" 3 . Insert payload in Position name and Title test" onmouseover = "alertdocument.cookie 4 .Click...