CVE-2020-35309: Improper Neutralization of Input During Web Page Generation

Bakeshop Online Ordering System in PHP/MySQLi 1.0 is affected by cross-site scripting XSS which allows remote attackers to inject an arbitrary web script or HTML in admin dashboard - "Categories"...

PT-2021-11747

Name of the Vulnerable Software and Affected Versions: Bakeshop Online Ordering System in PHP/MySQLi version 1.0 Description: The issue allows remote attackers to inject an arbitrary web script or HTML in the admin dashboard, specifically in the "Categories" section, due to cross-site scripting...

FV Flowplayer Video Player < 7.4.38.727 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin did not sanitise the fvwpfvvideoplayersrc parameter when creating or editing the video player, which will then be triggered when viewing the table of players in the admin dashboard...

Modal Survey < 2.0.1.8.2 - Authenticated Reflected Cross-Site Scripting (XSS)

The plugin did not sanitise the msuid parameter from the survey participants page in the admin Dashboard, leading to a reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=modalsurveyparticipants=%27%3E%3Cscript%3Ealert%28123%29%3B%3C%2Fscript%3E...

CVE-2020-35745

PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, doctors, patients, change admin password, get appointment history and access all session logs...

CVE-2020-35745

PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, doctors, patients, change admin password, get appointment history and access all session logs...

CVE-2020-35745

PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, doctors, patients, change admin password, get appointment history and access all session logs...

PT-2021-11841 · Unknown · Phpgurukul Hospital Management System

Name of the Vulnerable Software and Affected Versions: PHPGURUKUL Hospital Management System version 4.0 Description: The issue allows attackers to access all data of users, doctors, patients, change admin password, get appointment history and access all session logs due to improper restriction o...

CVE-2020-35136

Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilenametemplate parameter to admin/tools/dolibarrexport.php...

CVE-2020-35136

Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilenametemplate parameter to admin/tools/dolibarrexport.php...

Remote code execution

Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilenametemplate parameter to admin/tools/dolibarrexport.php...

CVE-2020-35136

Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilenametemplate parameter to admin/tools/dolibarrexport.php...

CVE-2020-35136

Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilenametemplate parameter to admin/tools/dolibarrexport.php...

CVE-2020-35136: Improper Neutralization of Argument Delimiters in a Command

Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilenametemplate parameter to admin/tools/dolibarrexport.php...

U.S. General Services Administration: TAMS registration details API for admins open at https://tamsapi.gsa.gov/user/tams/api/usermgmnt/pendingUserDetails/

Summary: TAMS administrators are supposed to approve or deny all registration requests. The dashboard that shows these administrators details of a registration request calls the endpoint https://tamsapi.gsa.gov/user/tams/api/usermgmnt/pendingUserDetails/REGISTRATIONID, where REGISTRATIONID is...

Cross-site Scripting (XSS)

s-cart is vulnerable to cross-site scirpting XSS. An attacker is able to inject and execute malicious script via the search functionality of the admin dashboard in core/src/Admin/Controllers/AdminOrderController.phpindex...

CVE-2020-28457

This affects the package s-cart/core before 4.4. The search functionality of the admin dashboard in core/src/Admin/Controllers/AdminOrderController.phpindex is vulnerable to XSS...

CVE-2020-28457

This affects the package s-cart/core before 4.4. The search functionality of the admin dashboard in core/src/Admin/Controllers/AdminOrderController.phpindex is vulnerable to XSS...

Cross site scripting

This affects the package s-cart/core before 4.4. The search functionality of the admin dashboard in core/src/Admin/Controllers/AdminOrderController.phpindex is vulnerable to XSS...

CVE-2020-28457 Cross-site Scripting (XSS)

This affects the package s-cart/core before 4.4. The search functionality of the admin dashboard in core/src/Admin/Controllers/AdminOrderController.phpindex is vulnerable to XSS...