PT-2022-24355 · Aerocms · Aerocms

Name of the Vulnerable Software and Affected Versions: AeroCMS version 0.0.1 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability in the /admin/profile.php component. Recommendations: For AeroCMS version 0.0.1,...

Advanced School Management System SQL Injection Vulnerability (CNVD-2022-68955)

Advanced School Management System is a school management system developed by Angel Jude Reyes Suarez. v1.0 of Advanced School Management System is vulnerable to SQL injection, which originates from /school/model /getadminprofile.php?myindex=The page lacks validation for external input SQL...

CVE-2022-32381

itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/getadminprofile.php?myindex=...

Advanced School Management System SQL注入漏洞

Advanced School Management System is a school management system developed by Angel Jude Reyes Suarez. v1.0 of Advanced School Management System is vulnerable to SQL injection, which originates from /school/model /getadminprofile.php?myindex=The page lacks validation for external input SQL...

CVE-2022-27478

Victor v1.0 was discovered to contain a remote code execution RCE vulnerability via the component admin/profile.php?section=admin...

CVE-2022-27478

Victor v1.0 was discovered to contain a remote code execution RCE vulnerability via the component admin/profile.php?section=admin...

CVE-2022-27478

Victor v1.0 was discovered to contain a remote code execution RCE vulnerability via the component admin/profile.php?section=admin...

CVE-2022-29020

ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar...

CVE-2022-29020

ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar...

ForestBlog 跨站脚本漏洞

ForestBlog is an application. A personal blog. A security vulnerability exists in ForestBlog that allows admin/profile/save userAvatar XSS during the addition of a user avatar...

CVE-2022-29020: Improper Neutralization of Input During Web Page Generation

ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar...

Online Banquet Booking System 1.0 Cross Site Request Forgery

Exploit Title: Online Banquet Booking System - 'change admin credentials' Cross-Site Request Forgery CSRF Date: 04/04/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/online-banquet-booking-system-using-php-and-mysql/ Version: 1.0...

CVE-2021-39348

The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $customprofile parameter found in the /inc/admin/views/backend-user-profile.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in version...

CVE-2021-41916

A Cross-Site Request Forgery CSRF vulnerability in webTareas version 2.4 and earlier allows a remote attacker to create a new administrative profile and add a new user to the new profile. without the victim's knowledge, by enticing an authenticated admin user to visit an attacker's web page...

webTareas 跨站请求伪造漏洞

webTareas is a web-based open source collaboration tool. The product supports features such as project management, bug tracking, content management and meeting management. A security vulnerability exists in webTareas, which can be exploited by an attacker to create a new administrative profile, a...

Bus Pass Management System 1.0 - 'adminname' Stored Cross-Site Scripting (XSS)

Exploit Title: Bus Pass Management System 1.0 - 'adminname' Stored Cross-Site Scripting XSS Date: 2021-09-08 Exploit Author: Emre Aslan Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/wp-content/uploads/2021/07/Bus-Pass-Management-System-Using-PHP-MySQL.zip Version:...

PT-2021-10212 · Unknown · Ignited Cms

Name of the Vulnerable Software and Affected Versions: IgnitedCMS version 1.0 Description: The issue allows remote attackers to obtain sensitive information and gain privilege via the component "/admin/profile/save profile". This is a Cross Site Request Forgery CSRF issue, which can be exploited ...

CVE-2020-18694: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF in IgnitedCMS v1.0 allows remote attackers to obtain sensitive information and gain privilege via the component "/admin/profile/saveprofile"...

IgnitedCMS 跨站请求伪造漏洞

Ignited CMS is a content management system CMS. A cross-site request forgery vulnerability exists in IgnitedCMS, which stems from the product /admin/profile/saveprofile failing to validate that a request is from a trusted user. This vulnerability can be exploited to obtain sensitive information a...

CVE-2021-36622

Sourcecodester Online Covid Vaccination Scheduler System 1.0 is affected vulnerable to Arbitrary File Upload. The admin panel has an upload function of profile photo accessible at http://localhost/scheduler/admin/?page=user. An attacker could upload a malicious file such as shell.php with the...