CVE-2022-24857 Multi factor authentication bypass in django-mfa3

django-mfa3 is a library that implements multi factor authentication for the django web framework. It achieves this by modifying the regular login view. Django however has a second login view for its admin area. This second login view was not modified, so the multi factor authentication can be...

CVE-2022-24857

CVE-2022-24857 affects django-mfa3 prior to 0.5.0 where the admin login view was not modified, allowing bypass of MFA for users with both django-mfa3 (

PT-2022-16931 · Django +1 · Django +1

Name of the Vulnerable Software and Affected Versions: django-mfa3 versions prior to 0.5.0 Description: The issue is related to a library that implements multi-factor authentication for the Django web framework. It modifies the regular login view but does not modify the second login view for the...

CVE-2022-24131

DouPHP v1.6 Release 20220121 is affected by Cross Site Scripting XSS through /admin/login.php in the background, which will lead to JavaScript code execution...

CVE-2022-24131

DouPHP v1.6 Release 20220121 is affected by Cross Site Scripting XSS through /admin/login.php in the background, which will lead to JavaScript code execution...

CVE-2022-24131

DouPHP v1.6 Release 20220121 is affected by Cross Site Scripting XSS through /admin/login.php in the background, which will lead to JavaScript code execution...

DouCo DouPHP 跨站脚本漏洞

DouCo DouPHP is a lightweight enterprise content management system CMS from China's DouCo Network Technology. DouCo DouPHP v1.6 has a security vulnerability that originates from cross-site scripting XSS in the backend via /admin/login.php, which results in the execution of JavaScript code...

Luocms SQL Injection Vulnerability (CNVD-2022-20134)

Luocms is an article management system. A SQL injection vulnerability exists in Luocms v2.0, which stems from a lack of validation of external input SQL statements in /admin/login.php. An attacker could use this vulnerability to execute illegal SQL commands to steal sensitive database data...

CVE-2022-24600

Luocms v2.0 is affected by SQL Injection through /admin/login.php. An attacker can log in to the background through SQL injection statements...

CVE-2022-24600

Luocms v2.0 is affected by SQL Injection through /admin/login.php. An attacker can log in to the background through SQL injection statements...

CVE-2022-24600

Luocms v2.0 is affected by SQL Injection through /admin/login.php. An attacker can log in to the background through SQL injection statements...

Sql injection

Luocms v2.0 is affected by SQL Injection through /admin/login.php. An attacker can log in to the background through SQL injection statements...

Unrestricted Upload of File with Dangerous Type

Description Malicious user can bypass checking and upload .phtm or .php6 file which leads to stored XSS. Proof of Concept - Step 1: Login as admin at https://demo.microweber.org/demo/admin/ - Step 2: Go to Websites setting and Edit any page https://demo.microweber.org/demo/admin/page/24/edit -...

CVE-2022-24600

Luocms v2.0 is affected by SQL Injection through /admin/login.php. An attacker can log in to the background through SQL injection statements...

CVE-2022-0134

The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack...

CVE-2022-24223

AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php...

CVE-2022-24223

AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php...

WordPress plugin 跨站请求伪造漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. WordPress NextScripts:Social Networks Auto-Poster plugin is vulnerable to cross-site request forgery in versions prior to 4.3.25. The vulnerability stems from the fact that there is no CSRF check...

Atom CMS SQL注入漏洞

Atom CMS is a content management system. Atom CMS suffers from a SQL injection vulnerability that originates from a SQL injection vulnerability in the /admin/login.php page...

WordPress plugin 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. WordPress Link Library plugin in versions prior to 7.2.8 is vulnerable to cross-site request forgery, which stems from a WEB application that does not adequately verify that requests are coming...