PT-2023-11615 · Beescms · Beescms

Name of the Vulnerable Software and Affected Versions: beescms version 4 Description: A Cross Site Request Forgery CSRF issue allows attackers to delete the administrator account via a crafted request to "/admin/admin admin.php". This can be exploited by sending a malicious request to the specifi...

PT-2023-18512 · Sourcecodester · Sourcecodester Online Pizza Ordering System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Pizza Ordering System version 1.0 Description: A critical issue has been found in the SourceCodester Online Pizza Ordering System, affecting the file admin/ajax.php?action=save settings. The manipulation of the img...

xxl-job 跨站脚本漏洞

XXL-JOB is a distributed task scheduling platform based on the java language from the Xu Xue Li XXL-JOB community. A security vulnerability exists in xxl-job, which originates from the successful execution of loads uploaded via HTML in /xxl-job-admin/user/add and /xxl-job-admin/user/update...

PT-2023-17199 · Unknown · Sourcecodester Young Entrepreneur E-Negosyo System

Name of the Vulnerable Software and Affected Versions: SourceCodester Young Entrepreneur E-Negosyo System version 1.0 Description: A critical vulnerability has been found in the system, affecting an unknown function of the file admin/products/controller.php?action=add. The manipulation of the ima...

PT-2023-17032 · Rebuild · Rebuild

Name of the Vulnerable Software and Affected Versions: Rebuild versions up to 3.2.3 Description: A critical vulnerability was found in the function queryListOfConfig of the file /admin/robot/approval/list. The manipulation of the argument q leads to sql injection. The attack can be launched...

PT-2023-17020 · Unknown · Xiaobingby Teacms

Name of the Vulnerable Software and Affected Versions: XiaoBingBy TeaCMS versions up to 2.0.2 Description: A critical vulnerability has been found in XiaoBingBy TeaCMS, affecting the file /admin/getallarticleinfo. The manipulation of the searchInfo argument leads to sql injection. The attack can ...

PT-2023-20798 · Unknown · Kirin Fortress Machine

Name of the Vulnerable Software and Affected Versions: Kirin Fortress Machine version 1.7-2020-0610 Description: A SQL Injection issue allows attackers to execute arbitrary code via the "/admin.php?controller=admin commonuser" API endpoint, specifically through the controller parameter. This...

PT-2023-21306 · Typecho · Typecho

Name of the Vulnerable Software and Affected Versions: Typecho version 1.2.0 Description: A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the Comment Manager component, specifically through the "/admin/manage-comments.php" API endpoint. This enables the attacke...

PT-2023-16980 · Sourcecodester · Sourcecodester Gadget Works Online Ordering System

Name of the Vulnerable Software and Affected Versions: SourceCodester Gadget Works Online Ordering System version 1.0 Description: A problematic issue has been found in the Products Handler component, specifically affecting an unknown part of the file admin/products/controller.php?action=add. The...

CVE-2023-1365

A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/ajax.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The...

PT-2023-19761 · Pmb · Pmb

Name of the Vulnerable Software and Affected Versions: PMB version 7.4.6 Description: A reflected cross-site scripting XSS issue was found in PMB via the query parameter at "/admin/convert/export z3950.php". This allows for potential malicious script execution. Recommendations: For PMB version...

PT-2023-16617 · Sourcecodester · Sourcecodester Auto Dealer Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Auto Dealer Management System version 1.0 Description: A critical issue has been discovered, affecting an unknown function of the file /adms/admin/?page=user/manage user. The manipulation of the id argument leads to SQL...

PT-2023-16561 · Phpcrazy · Phpcrazy

Name of the Vulnerable Software and Affected Versions: PHPCrazy version 1.1.1 Description: A problematic vulnerability was found in PHPCrazy, affecting the file "admin/admin.php?action=users&mode=info&user=2". The manipulation of the username argument leads to cross-site scripting. The attack can...

CVE-2022-46951

Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=deleteuploads...

PT-2023-15112 · Unknown · Dynamic Transaction Queuing System

Name of the Vulnerable Software and Affected Versions: Dynamic Transaction Queuing System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/admin/ajax.php?action=delete uploads" API endpoint...

PT-2023-15113 · Unknown · Dynamic Transaction Queuing System

Name of the Vulnerable Software and Affected Versions: Dynamic Transaction Queuing System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/admin/ajax.php?action=delete user" API endpoint...

PT-2023-15887 · Unknown · Nflpick-Em.Com

Name of the Vulnerable Software and Affected Versions: nflpick-em.com versions up to 2.2.x Description: A problematic vulnerability was found in nflpick-em.com, affecting the Load Users function of the file html/includes/runtime/admin/JSON/LoadUsers.php. The manipulation of the sort argument lead...

PT-2022-28089 · Ayacms · Ayacms

Name of the Vulnerable Software and Affected Versions: AyaCMS version 3.1.2 Description: The issue allows for file deletion via the /aya/module/admin/fst del.inc.php endpoint. Recommendations: For AyaCMS version 3.1.2, as a temporary workaround, consider restricting access to the...

PT-2022-27751 · Unknown · Helmet Store Showroom Site

Name of the Vulnerable Software and Affected Versions: Helmet Store Showroom Site version 1.0 Description: The issue concerns a SQL Injection vulnerability. It can be exploited via the "/hss/admin/?page=client/manage client&id=" API endpoint, specifically through the id variable. Recommendations:...

PT-2022-27746 · Unknown · Helmet Store Showroom Site

Name of the Vulnerable Software and Affected Versions: Helmet Store Showroom Site version 1.0 Description: The issue is related to SQL Injection, which can be exploited via the "/hss/admin/?page=products/view product&id=" endpoint. The id variable is vulnerable to injection attacks...