PT-2023-31195 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS version 5.0.0 Description: A Cross-Site Request Forgery CSRF issue was discovered in JFinalCMS. The vulnerability can be exploited via the "/admin/friend link/delete" API endpoint. Recommendations: For JFinalCMS version 5.0.0, as a...

PT-2023-30442 · Webid · Webid

Name of the Vulnerable Software and Affected Versions: WeBid versions 1.2.2 and earlier Description: The issue allows for code injection via the "admin/categoriestrans.php" endpoint. This could potentially lead to unauthorized access or control of the system. Recommendations: For WeBid versions...

Service Provider Management System Security Vulnerability

Service Provider Management System is a web-based application developed by Carlo Montero, an individual developer. It is designed to provide dynamic web sites for service provider companies. A security vulnerability exists in Service Provider Management System version v.1.0 that originates from a...

DiDi KnowSearch Security Breach

DiDi KnowSearch is a zero-intrusion, multi-tenant Elasticsearch GUI control platform built around clustering and indexing for Elasticsearch R&D and O&M staff at China's DiDi. A security vulnerability exists in didi KnowSearch versions 0.3.2 and 0.3.1.2, which stems from certain unknown processing...

CVE-2023-38206

Adobe ColdFusion versions 2018u18 and earlier, 2021u8 and earlier and 2023u2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints...

PT-2023-26791

Name of the Vulnerable Software and Affected Versions emlog version 2.1.9 Description A SQL injection issue was discovered in emlog via the "/admin/user.php" API endpoint. This allows for potential exploitation. Recommendations For emlog version 2.1.9, consider restricting access to the...

PT-2023-22643 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions =2.0.44 Description: Reflected XSS affects the mode parameter in the "/admin" functionality of the web application. Recommendations: For versions =2.0.44, update to a version greater than 2.0.44 to resolve the issue. As a...

PT-2023-20940 · Pluck Cms · Pluck Cms

Name of the Vulnerable Software and Affected Versions: Pluck CMS versions 4.7.15 through 4.7.16-dev4 Description: The issue is related to a Cross Site Scripting XSS vulnerability. It affects the /admin.php endpoint, allowing remote attackers to run arbitrary code via the upload of a crafted html...

PT-2023-24999 · Bloofox · Bloofox

Name of the Vulnerable Software and Affected Versions: bloofox version 0.5.2.1 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the tid parameter at the "admin/index.php?mode=settings&page=tmpl&action=edit" endpoint. Recommendations: For...

PT-2023-23778 · Otcms · Otcms

Name of the Vulnerable Software and Affected Versions: OTCMS versions up to 6.62 Description: A vulnerability was found in OTCMS, affecting some unknown functionality of the file "/admin/read.php?mudi=announContent". The manipulation of the url argument leads to path traversal. The exploit has be...

PT-2023-12145 · Tp5Cms · Tp5Cms

Name of the Vulnerable Software and Affected Versions: tp5cms versions through 2017-05-25 Description: An issue was discovered in the software, where the "admin.php/system/set.html" endpoint has a cross-site scripting XSS vulnerability via the keywords parameter. Recommendations: For versions...

bloofoxCMS SQL注入漏洞

bloofoxCMS is bloofox bloofoxCMS individual developers of a Php-based text content management system. A security vulnerability exists in bloofoxCMS version v0.5.2.1, which stems from a tid parameter found to contain an SQL injection vulnerability via...

PT-2023-25001 · Bloofox · Bloofox

Name of the Vulnerable Software and Affected Versions: bloofox version 0.5.2.1 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the userid parameter at the "admin/index.php?mode=user&action=edit" endpoint. Recommendations: For bloofox version 0.5.2.1,...

PT-2023-24998 · Bloofox · Bloofox

Name of the Vulnerable Software and Affected Versions: bloofox version 0.5.2.1 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the lid parameter at the "admin/index.php?mode=settings&page=lang&action=edit" endpoint. Recommendations: For...

PT-2023-24402 · Phpok · Phpok

Name of the Vulnerable Software and Affected Versions: phpok version 6.4.100 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability in the "/admin.php?c=upload" API endpoint, specifically the c parameter set to...

PT-2023-22517 · Unknown · Sourcecodester Local Service Search Engine Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Local Service Search Engine Management System version 1.0 Description: A problematic issue was found in the system, affecting the /admin/ajax.php?action=save area file, specifically the POST Parameter Handler component. The...

PT-2023-24342 · Sourcecodester · Sourcecodester Faculty Evaluation System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Faculty Evaluation System version 1.0 Description: The issue concerns SQL Injection vulnerability. It can be exploited via the "/eval/admin/manage task.php?id=" API endpoint, specifically through the id variable. Recommendation...

PT-2023-23484 · Sourcecodester · Sourcecodester Faculty Evaluation System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Faculty Evaluation System version 1.0 Description: The issue is related to SQL Injection, which can be exploited via the "/eval/admin/view faculty.php?id=" endpoint. This allows for potential manipulation of database queries...

PT-2023-20770 · Sourcecodester · Sourcecodester Lost/Found Information System

Name of the Vulnerable Software and Affected Versions: SourceCodester Lost and Found Information System version 1.0 Description: A critical issue affects the GET Parameter Handler component in the file admin/?page=categories/view category, where the manipulation of the id argument leads to sql...

PT-2023-20769 · Sourcecodester · Sourcecodester Lost/Found Information System

Name of the Vulnerable Software and Affected Versions: SourceCodester Lost and Found Information System version 1.0 Description: A critical issue was found in the function manager category of the file admin/?page=categories/manage category of the component GET Parameter Handler. The manipulation ...