CVE-2022-43031

DedeCMS v6.1.9 is affected by a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to arbitrarily add Administrator accounts and modify Admin passwords. The NVD entry (CVE-2022-43031) rates this as CVSS v3.1: 8.8 (High) with Network attack vector, no privileges required, user...

CVE-2022-42751

CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative permissions...

Cross-Site Scripting (XSS)

apache-geode is vulnerable to cross-site scripting. The vulnerability exists in multiple functions due to data injection when using pulse web application which allows an attacker to steal the admin's session cookie for the admin account...

CVE-2022-32176 Gin-vue-admin - Unrestricted File Upload

In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the "Compress Upload" functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the...

CVE-2022-42237

A SQL Injection issue in Merchandise Online Store v.1.0 allows an attacker to log in to the admin account...

Sql injection

A SQL Injection issue in Merchandise Online Store v.1.0 allows an attacker to log in to the admin account...

CVE-2022-42237

A SQL Injection issue in Merchandise Online Store v.1.0 allows an attacker to log in to the admin account...

CVE-2022-42237

A SQL Injection issue in Merchandise Online Store v.1.0 allows an attacker to log in to the admin account...

CVE-2022-32177

CVE-2022-32177 concerns Gin-Vue-Admin versions v2.5.1–v2.5.3beta, where Unrestricted File Upload via the Media Library’s Normal Upload can trigger JavaScript execution. When an admin views the uploaded file, a low-privilege attacker may gain access to the admin’s cookie, enabling account takeover...

CVE-2022-32177 Gin-vue-admin - Unrestricted File Upload

In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'Normal Upload' functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the...

CVE-2022-41475

RPCMS v3.0.2 is affected by a Cross-Site Forgery (CSRF) vulnerability that allows attackers to arbitrarily add an administrator account. The incident is documented across multiple sources (NVD CVE-2022-41475, Red Hat, PRion, CNNVD, CVE listings) with a common description. The CVSS v3.1 base score...

CVE-2022-31228

Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. A remote unauthenticated attacker can potentially exploit this vulnerability and gain access to an admin account...

CVE-2022-31228

Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. A remote unauthenticated attacker can potentially exploit this vulnerability and gain access to an admin account...

Code injection

Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. A remote unauthenticated attacker can potentially exploit this vulnerability and gain access to an admin account...

CVE-2022-31228

Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. A remote unauthenticated attacker can potentially exploit this vulnerability and gain access to an admin account...

CVE-2022-31228

Dell EMC XtremIO X2 versions prior to 6.4.0-22 are affected by a brute-force/authentication limitation vulnerability. An unauthenticated, remote attacker can potentially exploit this to gain access to an administrator account. The issue is due to insufficient limits on authentication attempts. Im...

CVE-2022-31228

Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. A remote unauthenticated attacker can potentially exploit this vulnerability and gain access to an admin account...

Linktree: A malicious admin can be able to permanently disable a Owner(Admin) to access his account

Ability to disable access to account While exploring the Multiple Admin feature in the application. I noticed a behavior that can lead to permanently disabling an Owner Admin to access his account...

Insufficient Session Expiration

Description Active user sessions are not invalidated when that user is disabled. Proof of Concept Steps to reproduce: 1. Log in with an admin account. 2. Create a test user with the user role Normal & enable that user 3. Log in with the test user in a separate browser or private browser window 4...

Stored Cross-Site Scripting (XSS)

Description There is insufficient input validation in the pop-up notifications. Proof of Concept Steps to reproduce: 1. Log in to an admin account 2. Click on Ports - Manage Groups 3. Create a new Port Group with the Name alertdocument.location and an arbitrary Description 4. The XSS is triggered...