Sql injection

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via the useremail parameter at /admin/login.php...

Online Ordering System SQL注入漏洞

Online Ordering System is a multi-store ordering system for janobe individual developers. It can be used for any small business. A security vulnerability exists in Online Ordering System version v2.3.2 due to a SQL injection in the useremail parameter of its /admin/login.php component...

PT-2022-18343 · Sourcecodester · Sourcecodester Gym Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Gym Management System affected versions not specified Description: A critical issue has been found in the SourceCodester Gym Management System, affecting an unknown functionality of the file /mygym/admin/login.php. The...

Best Fee Management System SQL注入漏洞

Best Fee Management System is a fee management system by Mayuri K. Individual developer. SourceCodester Best Fee Management System suffers from a SQL injection vulnerability that originates in its adminclass.php component, where the operation of the login function on the parameter username result...

Cross site request forgery (csrf)

The Rename wp-login.php WordPress plugin through 2.6.0 does not have CSRF check in place when updating the secret login URL, which could allow attackers to make a logged in admin change them via a CSRF attack...

Hospital Management System SQL注入漏洞

Hospital Management System HMS is a computer system that helps manage health care-related information and helps health care providers do their jobs efficiently. hospital Management System v1.0 is vulnerable to a SQL injection vulnerability that originates in the adminlogin. A SQL injection issue...

Page Generator Plugin < 1.6.6 - Arbitrary Keywords Deletion/Duplication via CSRF

The plugin does not have CSRF check in place when deleting and duplicating keywords, which could allow attackers to make a logged in admin delete and duplicate arbitrary keywords via CSRF attacks PoC https://example.com/wp-admin/admin.php?page=page-generator-keywords=delete=3...

PT-2022-6303 · Dell Emc · Dell Emc Scg Policy Manager

Name of the Vulnerable Software and Affected Versions: Dell EMC SCG Policy Manager versions 5.10 through 5.12 Description: The issue is related to a Hard-coded Cryptographic Key. An attacker with knowledge of the hard-coded sensitive information could potentially exploit this to login to the syst...

CVE-2022-22485

In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 does not cause the administrator's invalid sign-on count to be incremented on the IBM Spectrum Protect Server. An attacker could exploit this vulnerability using brute force...

CVE-2022-20736

A vulnerability in the web-based management interface of Cisco AppDynamics Controller Software could allow an unauthenticated, remote attacker to access a configuration file and the login page for an administrative console that they would not normally have authorization to access. This...

Old Age Home Management System 1.0 - SQLi Authentication Bypass

Exploit Title: Old Age Home Management System 1.0 - SQLi Authentication Bypass Date: 12/06/2022 Exploit Author: twseptian Vendor Homepage: https://phpgurukul.com/old-age-home-management-system-using-php-and-mysql/ Software Link: https://phpgurukul.com/projects/Old-Age-Home-MS-using-PHP.zip Versio...

PT-2022-3486 · Schneider Electric · Conext Combox

Name of the Vulnerable Software and Affected Versions: Conext ComBox All Versions Description: The issue is related to insufficient restriction of excessive authentication attempts, which could allow a remote attacker to bypass security restrictions using a brute force attack. This is due to the...

CVE-2022-23168

The attacker could get access to the database. The SQL injection is in the username parameter at the login panel: username: admin'--...

WordPress plugin HC Custom WP-Admin URL 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2022-32022

Car Rental Management System v1.0 is vulnerable to SQL Injection via /ip/car-rental-management-system/admin/ajax.php?action=login...

CVE-2022-1589

The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector...

CVE-2022-1589

The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector...

CVE-2022-1589

The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector...

CVE-2022-1589

CVE-2022-1589 affects the WordPress plugin “Change wp-admin login” prior to version 1.1.0. The issue arises from insufficient authorization checks and missing CSRF protection when updating settings, enabling unauthenticated users to modify settings via CSRF vectors. Documented impact is unauthent...

GHSA-P9QW-FH38-X37F OpenCart Cross-site Scripting

OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity encoding. NOTE: this issue exists because of an incomplete fix for CVE-2020-10596. The vendor states "this is not a massive issue as you...