2713 matches found
CVE-2022-46738 CVE-2022-46738
The affected product exposes multiple sensitive data fields of the affected product. An attacker can use the SNMP command to get device mac address and login as admin...
Dataprobe iBoot-PDU 安全漏洞
The Dataprobe iBoot-PDU is a web-accessible managed PDU independently controlled outlet from Dataprobe USA. A security vulnerability exists in Dataprobe iBoot-PDU FW prior to version 1.42.06162022, which stems from the product exposing multiple sensitive data fields, and can be exploited by an...
CVE-2023-29837
Cross Site Scripting vulnerability found in Exelysis Unified Communication Solution EUCS v.1.0 allows a remote attacker to gain privileges via the URL path of the eucsAdmin login web page...
CVE-2023-2706
The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for...
Exelysis Unified Communication Solutions 跨站脚本漏洞
Exelysis Unified Communication Solutions EUCS is a unified communication solution from Exelysis, Inc. A security vulnerability exists in Exelysis Unified Communication Solutions version v.1.0, which stems from the presence of a cross-site scripting CSS vulnerability that could allow an attacker t...
CVE-2023-2641
A vulnerability was found in SourceCodester Online Internship Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file admin/login.php of the component POST Parameter Handler. The manipulation of the argument email leads to sql...
PT-2023-20621 · Sourcecodester · Sourcecodester Internship Portal Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Online Internship Management System version 1.0 Description: A critical issue affects the file admin/login.php of the component POST Parameter Handler. The manipulation of the email argument leads to sql injection. The attack c...
SourceCodester Online Internship Management System SQL注入漏洞
Online Internship Management System is an online internship management system for janobe individual developers. A SQL injection vulnerability exists in SourceCodester Online Internship Management System version 1.0, which stems from a problem in the file admin/login.php, where manipulation of the...
CVE-2022-41398
The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information...
Hardcoded credentials
The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information...
GHSA-FQ95-RX4Q-QGG2 Cross-site Scripting (XSS) in Admin Login too many attempts notice
Impact Malicious JavaScript has access to all the same objects as the rest of the web page, including access to cookies and local storage, which are often used to store session tokens. If an attacker can obtain a user's session cookie, they can then impersonate that user. Furthermore, JavaScript...
Stored XSS in the module named "Dashboard"
Description I tested the demo site you provided. I see that there is an XSS vulnerability. I hope you can check and provide a fix as soon as possible. Proof of Concept link video PoC https://drive.google.com/file/d/19lzyLY20fn0WdgRxsIrIRSfkrq36j7s5/view?usp=sharing Steps 1.Login as administrator...
Side Cart Woocommerce < 2.2 - Settings Reset via CSRF
The plugin does not have CSRF check when reseting its Settings, which could allow attackers to make logged in admins perform such action via a CSRF attack Make a logged in admin open https://example.com/wp-admin/admin.php?page=side-cart-woocommerce-settings&reset=yes...
BizLibrary <= 1.1 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Login as Admin. 2. Go to...
Video List Manager <= 1.7 - Admin+ SQL Injection
The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin SELECT query: 1. Log in as admin. 2. Visit the following path on the site:...
CVE-2023-29622
Purchase Order Management v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /purchaseorder/admin/login.php...
CVE-2023-29626
Yoga Class Registration System 1.0 was discovered to contain a SQL injection vulnerability via the cid parameter at /admin/login.php...
CVE-2023-29626
Yoga Class Registration System 1.0 was discovered to contain a SQL injection vulnerability via the cid parameter at /admin/login.php...
