Hardcoded credentials

Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel...

CVE-2022-24571

Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...

CVE-2022-24571

Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...

CVE-2022-24571

Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...

Sql injection

Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...

CVE-2022-24571

Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access...

CVE-2022-24571

CVE-2022-24571 involves Car Driving School Management System v1.0, where the login page is vulnerable to SQL injection. The root cause is improper input handling on the username parameter, enabling attackers to alter the SQL query and bypass authentication. This can grant admin access and potenti...

Privilege Escalation

dolibarr/dolibarr is vulnerable to privilege escalation. Low privileged attacker is able to update their login name which should only be updated by admin allowing the attacker to gain access to sensitive information and elevate privileges...

CVE-2021-25010

The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Scripting issues...

CVE-2021-25010

The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Scripting issues...

Cross site request forgery (csrf)

In the Orange Form WordPress plugin through 1.0, the processbulkaction function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter $id. Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually...

CVE-2022-24620

Piwigo version 12.2.0 is vulnerable to stored cross-site scripting XSS, which can lead to privilege escalation. In this way, admin can steal webmaster's cookies to get the webmaster's access...

Vulnerabilities fixed in Trend Micro Server Protect

Trend Micro has fixed multiple vulnerabilities in Server Protect. The vulnerability with reference CVE-2022-25329 allows a remote malicious person to misuse a hardcoded password in order to perform administrative actions. perform. The other vulnerabilities allow an authenticated malicious person...

UPchieve: All user password hash can be seen from admin panel

Summary: During my primary research I found that api/users?page=1&userId=&firstName=test&lastName=&email=&partnerOrg=&highSchool= this endpoint gives hashed password of all users. Steps To Reproduce: + Login to Admin and go to Admin-- Search Users. + We see a request like this was send and in...

CVE-2022-23650

Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and...

CVE-2020-8242

Unsanitized user input in ExpressionEngine = 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/admin control panel access to execute the attack...

Sql injection

Unsanitized user input in ExpressionEngine = 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/admin control panel access to execute the attack...

CVE-2022-22922

TP-Link TL-WA850RE Wi-Fi Range Extender before v6200923 was discovered to use highly predictable and easily detectable session keys, allowing attackers to gain administrative privileges...

CVE-2022-24985

Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to bypass authentication and access the administrative section of other forms hosted on the same web server. This is relevant only when an organization hosts more than one of these forms on their server...

CVE-2021-4134

The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found in the /inc/api/class-view.php file which allows attackers with administrative level permissions to inject arbitrary SQL queries to obtain sensiti...