CVE-2023-29626

Yoga Class Registration System 1.0 was discovered to contain a SQL injection vulnerability via the cid parameter at /admin/login.php...

CVE-2023-29622

Purchase Order Management v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /purchaseorder/admin/login.php...

hiWeb Migration Simple <= 2.0.0.1 Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins. The hiweb-migration-simple plugin is vulnerable to POST based XSS on endpoint...

PT-2023-17282 · Unknown · Sourcecodester Online Payroll System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Payroll System version 1.0 Description: A critical issue affects some unknown functionality of the file /admin/login.php. The manipulation of the username argument leads to sql injection. The attack may be launched...

Site Reviews < 6.7.1 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Login as Admin. 2. Go to...

Dynamic Transaction Queuing System SQL注入漏洞

Dynamic Transaction Queuing System is a dynamic transaction queuing system using PHP/MySQL by Carlo Montero's personal developer. A security vulnerability exists in version v1.0 of the Dynamic Transaction Queuing System, which stems from an SQL injection issue in /admin/ajax.php?action=login...

CVE-2023-26856

Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/ajax.php?action=login...

Art Gallery Management System Project v1.0 - SQL Injection (Authenticated) Vulnerability

Exploit Title: Art Gallery Management System Project v1.0 - SQL Injection sqli authenticated Exploit Author: Rahul Patwari Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/projects/Art-Gallery-MS-PHP.zip Version: 1.0 Tested on: XAMPP / Windows 10 CVE : CVE-2023-23163...

Art Gallery Management System Project 1.0 SQL Injection

Exploit Title: Art Gallery Management System Project v1.0 - SQL Injection sqli Unauthenticated Date: 20/01/2023 Exploit Author: Rahul Patwari Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/projects/Art-Gallery-MS-PHP.zip Version: 1.0 Tested on: XAMPP / Windows 10 C...

CVE-2022-47613

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in QuantumCloud AI ChatBot plugin = 4.3.0 versions...

Simple Giveaways < 2.45.1 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Login with admin user and navigate to "Giveaways...

Array Networks APV products 命令注入漏洞

Array Networks APV products are a family of array load balancing and application delivery products from Array Networks, Inc. provides the availability, scalability, performance, security, and control necessary to keep applications running in their power band. A security vulnerability exists in...

Cross Site Scripting (XSS) in Assets

Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differen...

Shopping Cart & eCommerce Store < 5.4.3 - Admin+ LFI

The plugin does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks. 1. Login as Admin. 2. Go to wp-admin/admin.php?page=wp-easycart-products&subpage=products 3. Click on Import Products. Browse any file and click on import file. Intercept the...

CVE-2023-1357

A vulnerability, which was classified as critical, has been found in SourceCodester Simple Bakery Shop Management System 1.0. Affected by this issue is some unknown functionality of the component Admin Login. The manipulation of the argument username/password with the input admin' or 1=1 -- leads...

CVE-2023-1357

A vulnerability, which was classified as critical, has been found in SourceCodester Simple Bakery Shop Management System 1.0. Affected by this issue is some unknown functionality of the component Admin Login. The manipulation of the argument username/password with the input admin' or 1=1 -- leads...

CVE-2023-1357 SourceCodester Simple Bakery Shop Management System Admin Login sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Simple Bakery Shop Management System 1.0. Affected by this issue is some unknown functionality of the component Admin Login. The manipulation of the argument username/password with the input admin' or 1=1 -- leads...

CVE-2023-1357 SourceCodester Simple Bakery Shop Management System Admin Login sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Simple Bakery Shop Management System 1.0. Affected by this issue is some unknown functionality of the component Admin Login. The manipulation of the argument username/password with the input admin' or 1=1 -- leads...

PT-2023-16925 · Sourcecodester · Sourcecodester Gadget Works Online Ordering System

Name of the Vulnerable Software and Affected Versions: SourceCodester Gadget Works Online Ordering System version 1.0 Description: A critical issue was found in the component POST Parameter Handler, affecting an unknown part of the file /philosophy/admin/login.php. The manipulation of the user...

PT-2023-16924 · Sourcecodester · Sourcecodester Simple Bakery Shop Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Bakery Shop Management System version 1.0 Description: A critical issue has been found in the Admin Login component, where the manipulation of the username/password argument with the input admin' or 1=1 -- leads to SQL...