CVE-2025-5350 SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products

SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature accepted user-supplied URLs without proper validation, leading to server-side request forgery SSRF. Additionally, the...

PT-2025-42234

Name of the Vulnerable Software and Affected Versions Dahua embedded products affected versions not specified Description A security issue exists in Dahua embedded products. An attacker gaining normal user credentials can potentially access data restricted to administrator privileges, including...

CVE-2025-61777

Flag Forge is a Capture The Flag CTF platform. Starting in version 2.0.0 and prior to version 2.3.2, the /api/admin/badge-templates GET and /api/admin/badge-templates/create POST endpoints previously allowed access without authentication or authorization. This could have enabled unauthorized user...

EUVD-2017-18313

Malware in sbrugna...

EUVD-2019-7629

Malware in sbrugna...

Lovable VDP: Improper Authorization Leads to Editor can toggle admin-only workspace features (Lovable AI)

The API endpoint /workspaces//tool-preferences/aigateway/enable did not enforce proper authorization checks. As a result, an account with the Editor role was able to disable the workspace-wide admin-only Lovable AI feature, which powers key AI functionalities across the workspace...

CVE-2025-9103

A vulnerability was detected in ZenCart 2.1.0. Affected by this vulnerability is an unknown functionality of the component CKEditor. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The real existenc...

PT-2024-17909 · Softiron · Softiron Hypercloud

Name of the Vulnerable Software and Affected Versions: SoftIron HyperCloud versions 2.3.0 through 2.4.x Description: An issue exists where authenticated, but non-admin users can create data pools, potentially impacting the performance and availability of the backend software-defined storage...

CVE-2024-5678

Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authenticated admin-only SQL Injection in the Create Monitor feature...

CVE-2024-5678

CVE-2024-5678 affects Zoho ManageEngine Applications Manager versions 17.0900 and earlier. The vulnerability is an authenticated admin‑only SQL Injection in the Create Monitor feature, introduced by the underlying input handling in that function. Exploitation requires admin access, with no user i...

CVE-2024-5678 SQL Injection

Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authenticated admin-only SQL Injection in the Create Monitor feature...

CVE-2023-44766

A Cross Site Scripting XSS vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. NOTE: the vendor disputes this because this SEO-related header change can only be made by an admin, and allowing an admin to...

CVE-2022-45544

Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS 2.2.7-2 allows attacker to upload arbitrary files and execute arbitrary code via the tristao parameter. NOTE: this is disputed by the vendor because an admin is intentionally allowed to upload new executable PHP code, such as a theme...

MISSING INPUT CKECK WHEN SETTING NEW **QuorumCoefficient**

Lines of code Vulnerability details Impact In the setQuorumCoefficient , setDynamicQuorumParams functions when the admin sets a new QuorumCoefficient, there is no check on the newQuorumCoefficient parameter which means that a wrong QuorumCoefficient could be set either being very big or very smal...

PT-2022-13406 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: dolibarr/dolibarr versions prior to 16.0 Description: The issue concerns business logic errors in the dolibarr/dolibarr GitHub repository. Specifically, it allows low-privileged users to update their login name, a functionality that should be...

CVE-2021-25101

The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value, available to admin...

CVE-2021-24983

The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not sanitise and escape POSted parameters sent to the wpassetcleanupfetchactivepluginsicons AJAX action available to admin users, leading to a Reflected Cross-Site Scripting issue...

_isRevocable is tied to the address and can be set by anyone

Handle pauliax Vulnerability details Impact function vest has a parameter isRevocable that is tied to the account address of beneficiary. because anyone can call vest, it allows overriding benRevocable as many times as you want. I see several potential problems with this: 1. isRevocable sets glob...

CVE-2021-24301

The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting XSS in the 'hotjar script' textarea. The request did include a CSRF nonce that was properly verified by the server and this vulnerability could only be exploited by administrator users...

Reward rates can be changed through flash borrows

Handle @cmichelio Vulnerability details Vulnerability Details The rewards per market are proportional to their totalBorrows which can be changed by a large holder who deposits lots of collateral, takes out a huge borrow in the market, updates the rewards, and then unwinds the position. They'll on...