CVE-2022-3350

The Contact Bank WordPress plugin through 3.0.30 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-40311

Auth. admin+ Stored Cross-Site Scripting XSS in Fatcat Apps Analytics Cat plugin = 1.0.9 on WordPress...

CVE-2022-38108

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands...

CVE-2022-38108 SolarWinds Platform Deserialization of Untrusted Data

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands...

CVE-2022-42176

In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access...

CVE-2022-41541

TP-Link AX10v1 V1211117 allows attackers to execute a replay attack by using a previously transmitted encrypted authentication message and valid authentication token. Attackers are able to login to the web application as an admin user...

CVE-2022-26375

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Mammothology AB Press Optimizer plugin = 1.1.1 on WordPress...

PT-2022-26325 · Unknown · Merchandise Online Store

Name of the Vulnerable Software and Affected Versions: Merchandise Online Store version 1.0 Description: A SQL Injection issue allows an attacker to log in to the admin account. Recommendations: For Merchandise Online Store version 1.0, consider temporarily restricting access to the admin login...

Exploit for CVE-2021-44103

CVE-2021-44103 A proof of concept for KONGA 0.14.9 - Privilege...

CVE-2022-41436

An issue in OXHOO TP50 OXH1.50 allows unauthenticated attackers to access the administrative panel via browsing to the URL http://deviceip/index1.html...

GitHub: Github app Privilege Escalation to Administrator/Owner of the Organization

Vulnerability description not provided...

CVE-2022-41643

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Accessibility plugin = 1.0.3 on WordPress...

Dell EMC XtremIO 安全漏洞

Dell EMC XtremIO is an all-flash, horizontally scalable enterprise storage array from Dell, Inc. A brute force vulnerability exists in Dell EMC XtremIO X2 versions prior to 6.4.0-22, which can be exploited by an unauthenticated, remote attacker to gain access to the administrator account...

Using ifAdmin modifier to forcefully interact with implementation contracts via _fallback() call.

Lines of code Vulnerability details Impact The modifier ifAdmin allows internal delegation to the implementation contract if caller is not admin by calling the fallback function which delegates the current call to implementation. This allows a user who is not admin to call to make a transaction...

CVE-2022-2554

The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege users such as admin to move them outside to the web root directory via a path traversal attack for example...

CVE-2022-2981

The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup...

CVE-2022-2448

The reSmush.it WordPress plugin before 0.4.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-31680

The vCenter Server contains an unsafe deserialisation vulnerability in the PSC Platform services controller. A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server...

CVE-2022-31680

The vCenter Server contains an unsafe deserialisation vulnerability in the PSC Platform services controller. A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server...

Design/Logic Flaw

The vCenter Server contains an unsafe deserialisation vulnerability in the PSC Platform services controller. A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server...