PT-2022-8910 · Liferay · Liferay Portal Server

Name of the Vulnerable Software and Affected Versions: Liferay Portal Server versions 7.2.0 GA1 through 7.3.5 GA6 Description: The issue allows an administrator user to inject commands through the Gogo Shell module, enabling the execution of any OS command on the Liferay Portal Server. This is...

H.H.G. Multistore SQL注入漏洞

H.H.G. Multistore is a software designed to manage multiple stores by the German company H.H.G. Multistore. A security vulnerability exists in H.H.G. Multistore v5.1.0 and below that allows an attacker to perform SQL injection via /admin/admin.php?module=adminaccessgroupedit&aagID...

Online Project Time Management System 1.0 Cross Site Scripting

Exploit Title: Online Project Time Management System 1.0 - Multiple Stored XSS Authenticated Date: 19/01/2022 Exploit Author: Felipe Alcantara Filiplain Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

Online Project Time Management System 1.0 - Multiple Stored Cross Site Scripting Vulnerabilities

Exploit Title: Online Project Time Management System 1.0 - Multiple Stored XSS Authenticated Exploit Author: Felipe Alcantara Filiplain Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

20K WordPress Sites Exposed by Insecure Plugin REST-API

More than 20,000 WordPress sites are vulnerable to malicious code injection, phishing scams and more as the result of a high-severity cross-site scripting XSS bug discovered in the WordPress Email Template Designer – WP HTML Mail, a plugin for designing custom emails. The new vulnerability...

CVE-2021-40694

CVE-2021-40694 affects Moodle-related components and is caused by insufficient escaping of the LaTeX preamble, enabling site administrators to read files accessible to the HTTP server system account. Reported impact per NVD: Confidentiality impact high; other impacts none; attack vector network; ...

PT-2022-13089 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 1.2.11 Description: The issue is related to incorrect permission assignment for critical resources, allowing non-admin users to access sensitive information of other users. This is a case of improper...

CVE-2021-44837

An issue was discovered in Delta RM 1.2. It is possible for an unprivileged user to access the same information as an admin user regarding the risk creation information in the /risque/administration/referentiel/json/create/categorie endpoint, using the idcat1 query parameter to indicate the risk...

SQL Injection

pimcore/pimcore, is vulnerable to SQL injection. The propertiesGetAction function in ClassificationstoreController.php does not properly sanitize the input, which allows a remote attacker to gain admin access to the database...

CVE-2022-23131

CVE-2022-23131 affects the Zabbix Frontend when SAML SSO is enabled (non-default). A malicious, unauthenticated actor can modify session data because user logins stored in the session are not verified, potentially escalating privileges to admin and taking over the frontend. The vulnerability requ...

Zabbix 安全漏洞

Zabbix Sia Zabbix is an open source monitoring system from the Latvian company Zabbix SIA Zabbix Sia. The system supports network monitoring, server monitoring, cloud monitoring, and application monitoring, etc. A security vulnerability exists in Zabbix Frontend, which stems from the fact that wi...

PHP Everywhere < 2.0.3 - Arbitrary Settings Update via CSRF

The plugin does not have CSRF check when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

PT-2022-1639 · Zabbix +1 · Zabbix +1

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The issue is related to the SAML SSO authentication in Zabbix. When SAML SSO authentication is enabled, a malicious actor can modify session data because the user login stored in the session...

CVE-2021-42562

An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-admin users having access to read and modify configuration or other components that should only be accessible by admin users...

CVE-2021-42562

An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-admin users having access to read and modify configuration or other components that should only be accessible by admin users...

CVE-2021-42562

An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-admin users having access to read and modify configuration or other components that should only be accessible by admin users...

CVE-2022-22111

In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged use...

BeyondTrust Remote Support 6.0 - Reflected Cross-Site Scripting (Unauthenticated) Vulnerability

Exploit Title: BeyondTrust Remote Support 6.0 - Reflected Cross-Site Scripting XSS Unauthenticated Google Dork: intext:"BeyondTrust" "Redistribution Prohibited" Exploit Author: Malcrove Vendor Homepage: https://www.beyondtrust.com/ Version: v6.0 and earlier versions Summary: Unauthenticated...

BeyondTrust Remote Support 6.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated)

Exploit Title: BeyondTrust Remote Support 6.0 - Reflected Cross-Site Scripting XSS Unauthenticated Google Dork: intext:"BeyondTrust" "Redistribution Prohibited" Date: 30/12/2021 Exploit Author: Malcrove Vendor Homepage: https://www.beyondtrust.com/ Version: v6.0 and earlier versions Summary:...

DayByDay CRM 授权问题漏洞

DayByDay CRM is an open source CRM Customer Relationship Management software, based on Laravel, that helps users keep track of clients, tasks, meetings and more. A security bypass vulnerability exists in DayByDay CRM, which can be exploited by an attacker to change any user's password and gain...