1834 matches found
CVE-2025-51991
XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection SSTI in the Administration interface, specifically within the HTTP Meta Info field of the Global Preferences Presentation section. An authenticated administrator can inject crafted Apache Velocity template code, which is...
CVE-2025-51991
XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection SSTI in the Administration interface, specifically within the HTTP Meta Info field of the Global Preferences Presentation section. An authenticated administrator can inject crafted Apache Velocity template code, which is...
Default Credentials in nginx-defender Configuration Files
Impact This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files config.yaml, docker-compose.yml contain default credentials defaultpassword: "changemeplease", GFSECURITYADMINPASSWORD=admin123. If users deploy nginx-defender without changing these...
CVE-2025-31988
HCL Digital Experience is susceptible to cross site scripting XSS in an administrative UI with restricted access...
CVE-2025-8954
A vulnerability was identified in PHPGurukul Hospital Management System 4.0. This affects an unknown part of the file /admin/doctor-specilization.php. The manipulation of the argument doctorspecilization leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...
Exploit for CVE-2025-8730
CVE-2025-8730 ā Authentication Bypass in Belkin F9K1009/F9K10...
CVE-2024-52680
EyouCMS 1.6.7 is vulnerable to Cross Site Scripting XSS in /login.php?m=admin&c=System&a=web&lang=cn...
The vulnerability in the FTP-server administrator web interface of Wing allows a hacker to increase their privileges.
The vulnerability in the FTP server administratorās web interface of Wing is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...
CVE-2025-8172
A vulnerability, which was classified as critical, was found in itsourcecode Employee Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit ha...
Code-Projects Voting System ę³Øå „ę¼ę“
Voting System is an election system. Voting System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements for parameter ID in file /admin/votersedit.php. An attacker can exploit this vulnerability to execute illegal SQL commands...
PHPGurukul Vehicle Parking Management System ę³Øå „ę¼ę“
Vehicle Parking Management System is a parking management system. Vehicle Parking Management System suffers from a SQL injection vulnerability that stems from an error in the parameter del in the file /admin/manage-incomingvehicle.php that lacks validation of externally entered SQL statements. An...
CampCodes Advanced Online Voting System ę³Øå „ę¼ę“
CampCodes Advanced Online Voting System is an advanced online voting system from CampCodes, Inc. An injection vulnerability exists in CampCodes Advanced Online Voting System version 1.0, which stems from incorrect manipulation of the parameter ID in the file /admin/votersdelete.php, resulting in...
CVE-2025-34074
An authenticated remote code execution vulnerability exists in Luceeās administrative interface due to insecure design in the scheduled task functionality. An administrator with access to /lucee/admin/web.cfm can configure a scheduled job to retrieve a remote .cfm file from an attacker-controlled...
CVE-2025-34074 Lucee Admin Interface Authenticated Remote Code Execution via Scheduled Job File Write
An authenticated remote code execution vulnerability exists in Luceeās administrative interface due to insecure design in the scheduled task functionality. An administrator with access to /lucee/admin/web.cfm can configure a scheduled job to retrieve a remote .cfm file from an attacker-controlled...
CVE-2025-34074 Lucee Admin Interface Authenticated Remote Code Execution via Scheduled Job File Write
An authenticated remote code execution vulnerability exists in Luceeās administrative interface due to insecure design in the scheduled task functionality. An administrator with access to /lucee/admin/web.cfm can configure a scheduled job to retrieve a remote .cfm file from an attacker-controlled...
CVE-2025-34074
An authenticated remote code execution vulnerability exists in Luceeās administrative interface due to insecure design in the scheduled task functionality. An administrator with access to /lucee/admin/web.cfm can configure a scheduled job to retrieve a remote .cfm file from an attacker-controlled...
CVE-2025-6050
Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting XSS vulnerability in the admin interface. The vulnerability exists in the "displayablelinksjs" function, which fails to properly sanitize blog post titles before including them in JSON responses served via...
CVE-2025-24388
A vulnerability in the OTRS Admin Interface and Agent Interface versions before OTRS 8 allow parameter injection due to for an autheniticated agent or admin user. This issue affects: OTRS 7.0.X OTRS 8.0.X OTRS 2023.X OTRS 2024.X OTRS 2025.X OTRS Community Edition: 6.0.x Products based on the OTRS...
Mezzanine CMS has a Stored Cross-Site Scripting (XSS) vulnerability in the displayable_links_js function
Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting XSS vulnerability in the admin interface. The vulnerability exists in the "displayablelinksjs" function, which fails to properly sanitize blog post titles before including them in JSON responses served via...
GHSA-7PR5-W74R-JJJ7 Mezzanine CMS has a Stored Cross-Site Scripting (XSS) vulnerability in the displayable_links_js function
Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting XSS vulnerability in the admin interface. The vulnerability exists in the "displayablelinksjs" function, which fails to properly sanitize blog post titles before including them in JSON responses served via...