537 matches found
PT-2025-4751 · Teedy · Teedy
Name of the Vulnerable Software and Affected Versions: Teedy versions 1.11 and earlier Description: The issue allows for CSRF, enabling account takeover via POST "/api/user/admin". This can be exploited to gain unauthorized access to user accounts. Recommendations: For versions 1.11 and earlier, ...
Cross-site Scripting (XSS)
Overview microweber/microweber is a new generation CMS with drag and drop. Affected versions of this package are vulnerable to Cross-site Scripting XSS by an admin user who uploads a malicious backup file using the restore functionality at the /admin/module/view?type=adminbackup endpoint. The...
Exploit for Cross-site Scripting in Microweber
CVE-2024-33299 Stored Cross Site Scripting vulnerability in Mi...
PT-2024-17877 · Unknown · Code-Projects Chat System
Name of the Vulnerable Software and Affected Versions: code-projects Chat System version 1.0 Description: A vulnerability has been found in the code-projects Chat System. The issue affects an unknown function of the file /admin/update room.php of the component Chat Room Page. The manipulation of...
PT-2024-17836 · Code Projects · Hospital Management System
Name of the Vulnerable Software and Affected Versions: code-projects Hospital Management System version 1.0 Description: A critical issue has been found in the Hospital Management System, affecting some unknown functionality of the file /admin/index.php of the component Login. The manipulation of...
PT-2024-17707 · Classcms · Classcms
Name of the Vulnerable Software and Affected Versions: ClassCMS versions up to 4.8 Description: A critical issue has been found in the User Management Page component, specifically affecting an unknown functionality of the file "/admin?do=admin:user:editPost". This issue leads to improper handling...
PT-2024-36482 · Unknown · Online Nurse Hiring System
Name of the Vulnerable Software and Affected Versions: Online Nurse Hiring System version 1.0 Description: The issue is related to multiple SQL injection vulnerabilities found in the /admin/add-nurse.php component of the system. These vulnerabilities can be exploited via the gender and emailid...
PT-2024-36478 · Unknown · Phpgurukul Online Nurse Hiring System
Name of the Vulnerable Software and Affected Versions: phpgurukul Online Nurse Hiring System version 1.0 Description: A SQL injection issue was found in the /admin/index.php endpoint of the phpgurukul Online Nurse Hiring System, allowing remote attackers to execute arbitrary SQL commands and gain...
PT-2024-36428 · Unknown · Phpgurukul Online Nurse Hiring System
Name of the Vulnerable Software and Affected Versions: phpgurukul Online Nurse Hiring System version 1.0 Description: A SQL injection issue was found in the /admin/password-recovery.php endpoint via the mobileno parameter. This allows for potential exploitation of the system. Recommendations: For...
PT-2024-36452 · Unknown · Kashipara E-Learning Management System
Name of the Vulnerable Software and Affected Versions: Kashipara E-learning Management System version 1.0 Description: The issue concerns a SQL Injection vulnerability in the /admin/delete class.php endpoint. This allows for potential exploitation by injecting malicious SQL code. Recommendations:...
CVE-2024-53255 Reflected Cross-site Scripting in /admin?page=media via file Parameter in BoidCMS
BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In affected versions a reflected Cross-site Scripting XSS vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to...
PT-2024-16852 · Zzcms · Zzcms
Name of the Vulnerable Software and Affected Versions: ZZCMS version 2023 Description: A critical issue affects some unknown functionality of the file /admin/ad list.php?action=pass of the component Keyword Filtering. The manipulation of the keyword argument leads to SQL injection. The attack may...
PT-2024-34434 · Unknown · Kashipara E-Learning Management System Project
Name of the Vulnerable Software and Affected Versions: KASHIPARA E-learning Management System Project version 1.0 Description: A Stored Cross-Site Scripting XSS issue was discovered in the /admin/teachers.php endpoint, allowing remote attackers to execute arbitrary scripts via the firstname and...
PT-2024-34441 · Unknown · Kashipara E-Learning Management System Project
Name of the Vulnerable Software and Affected Versions: KASHIPARA E-learning Management System Project version 1.0 Description: A Stored Cross-Site Scripting XSS issue was found in the /admin/school year.php endpoint, specifically via the school year parameter. This allows remote attackers to...
PT-2024-16197 · Unknown · Sourcecodehero Clothes Recommendation System
Name of the Vulnerable Software and Affected Versions: SourceCodeHero Clothes Recommendation System version 1.0 Description: A critical issue has been discovered, allowing for SQL injection through the manipulation of the cat, subcat, t1, t2, and text arguments in the /admin/home.php?con=add...
PT-2024-33150 · Unknown · Client Management System
Name of the Vulnerable Software and Affected Versions: Client Management System version 1.0 Description: A SQL injection issue was discovered in the Client Management System via the Between Dates Reports parameter at the "/admin/bwdates-reports-ds.php" API endpoint. Recommendations: For Client...
PT-2024-33069 · Unknown · Phpgurukul User Registration & Login/User Management System
Name of the Vulnerable Software and Affected Versions: Phpgurukul User Registration & Login and User Management System version 3.2 Description: The issue is related to SQL Injection in the /admin//search-result.php endpoint via the searchkey parameter. This allows for potential exploitation. No...
PT-2024-39853 · Unknown · Sourcecodester Online Eyewear Shop
Name of the Vulnerable Software and Affected Versions: SourceCodester Online Eyewear Shop version 1.0 Description: A critical issue has been identified, affecting an unknown function of the file "/admin/?page=products/view product". The manipulation of the id argument leads to SQL injection. This...
PT-2024-27805 · Usvn · Usvn
Name of the Vulnerable Software and Affected Versions: User-friendly SVN USVN versions prior to 1.0.12 Description: The issue is related to improper input validation in the /admin/config/save endpoint, allowing administrators to execute arbitrary code via the fields siteTitle, siteIco, and...