CVE-2023-2279 WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_display

The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'adminpagedisplay' function. This makes it possible for unauthenticated attackers to delete or change plugin...

Store DOM XSS in Edit configuration

Description I noticed, your website is very secure. But you overlooked a flaw XSS Proof of Concept 1 .Login vs admin demo account and access admin page. 2 .Create a category titled "test456". 3 .Go to Configuration == Edit configuration. 4 .Change the "URL of your FAQ" data field with the payload...

CVE-2023-37688

Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Admin page...

CVE-2023-37688

Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Admin page...

CVE-2023-37688

Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Admin page...

CVE-2023-37687

Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting XSS vulnerability in the View Request of Nurse Page in the Admin portal...

Sql injection

Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Admin page...

CVE-2023-37688

Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Admin page...

PT-2023-26075 · Unknown · Maid Hiring Management System

Name of the Vulnerable Software and Affected Versions: Maid Hiring Management System version 1.0 Description: The issue is related to a SQL injection vulnerability found in the Admin page of the system. Recommendations: For Maid Hiring Management System version 1.0, consider restricting access to...

CVE-2023-37683

The CVE-2023-37683 entry concerns Online Nurse Hiring System v1.0 with a cross-site scripting (XSS) vulnerability in the Admin Profile Page. The available connected documents confirm the affected product and the vulnerability class but do not provide a vendor-specific patch version. Some sources ...

CVE-2023-37688

Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Admin page...

Maid Hiring Management System Cross-Site Scripting Vulnerability

PHPGurukul Maid Hiring Management System is a maid hiring management system from PHPGurukul, USA. A security vulnerability exists in Maid Hiring Management System v1.0, which is caused by a SQL injection vulnerability in the Admin page...

CVE-2023-37688: Improper Neutralization of Input During Web Page Generation

Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Admin page...

User Activity Tracking and Log < 4.0.9 - License Update/Deactivation via CSRF

Description The plugin does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks Make a logged in admin open a page with the code below To make them deactivate the license To make th...

Sql injection

emlog v2.1.9 was discovered to contain a SQL injection vulnerability via the component /admin/user.php...

DuxCMS 跨站请求伪造漏洞

DuxCMS is an open source content management system. A cross-site request forgery vulnerability exists in DuxCMS version 2.1, which originates from admin.php that allows remote attackers to modify application data via article/admin/content/add...

PT-2023-6376 · WordPress · Twittee Text Tweet Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Twittee Text Tweet WordPress plugin versions 1.0.0 through 1.0.8 Description: The issue arises from the plugin's failure to properly escape POST values, which are then printed back to the user inside one of the plugin's administrative pages...

CVE-2023-3986: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Simple Online Mens Salon Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/?page=user/list. The manipulation of the argument First Name/Last Name/Username leads to cross site scripting. Th...

PT-2023-27139

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Online Mens Salon Management System version 1.0 Description A critical issue has been found, affecting an unknown function of the file "/admin/?page=user/manage user&id=3". The manipulation of the id argument leads to SQL...

WPCode < 2.0.13.1 - Reflected XSS

Description The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting Make a logged in admin open https://example.com/wp-admin/admin.php?page=wpcode&a"alert/XSS/=2...