2394 matches found
CVE-2022-34814
Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view an administrative configuration page listing pending requests...
PT-2022-22366 · Jenkins · Jenkins Request Rename/Delete Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Request Rename Or Delete Plugin versions 1.1.0 and earlier Description: The issue arises from an incorrect permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view an administrative configuration...
CVE-2022-31063
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.111 the title of a document is not properly escaped in the search result of MyDocmanSearch widget and in the administration page of the locked documents. A malicious...
PT-2022-3300 · Trueconf · Trueconf Server
Name of the Vulnerable Software and Affected Versions: TrueConf Server version 4.3.7 Description: The issue is related to the failure to neutralize script-related HTML tags on the /admin/group/list/ webpage of the TrueConf Server software. This can allow a remote attacker to perform cross-site...
Online Railway Reservation System SQL注入漏洞
Sourcecodester Online Railway Reservation system is a web-based application that provides an online platform for rail or train station passengers or would-be passengers to view their schedules and reserve seats. Online Railway Reservation System v1.0 version contains a SQL injection vulnerability...
Prison Management System SQL注入漏洞
Prison Management System is a prison management system from Carlo Montero's personal developer. v1.0 of Prison Management System is vulnerable to SQL injection, which originates from the application /pms/admin/prisons/manageprison. php in the id parameter lack of SQL data filter escaping, an...
CVE-2022-33049
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/?page=user/manageuser...
ZZCMS SQL Injection Vulnerability (CNVD-2022-58309)
ZZCMS is a content management system CMS by the ZZCMS team in China. A security vulnerability exists in ZZCMS 2019 version, which can be exploited by an attacker to perform a SQL injection attack via the id parameter in /admin/showbad.php...
ZZCMS SQL Injection Vulnerability (CNVD-2022-58308)
ZZCMS is a content management system CMS by the ZZCMS team in China. A security vulnerability exists in ZZCMS 2019 version, which can be exploited by an attacker to perform a SQL injection attack via the id parameter in /admin/dlsendmail.php...
Product Show Room Site SQL Injection Vulnerability (CNVD-2022-48962)
Product Show Room Site is a product showroom site from Carlo Montero's personal developer. version 1.0 of Product Show Room Site is vulnerable to SQL injection, which originates from the /psrs/admin/?page=user/manageuser&id= page. SQL injection problem. No detailed vulnerability details are...
FoxyShop < 4.8.2 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/edit.php?posttype=foxyshopproduct=foxyshoptools=error=...
WordPress Newsletter plugin cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
CVE-2022-32354
Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/?page=user/manageuser&id=...
CVE-2022-32362
Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/categories/managecategory.php?id=...
CVE-2022-32367
Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/?page=inquiries/viewinquiry&id=...
CVE-2022-32364
Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/?page=products/manageproduct&id=...
CVE-2022-32340
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/?page=patients/viewpatient&id=...
CVE-2021-40678
In Piwigo 11.5.0, there exists a persistent cross-site scripting in the single mode function through /admin.php?page=batchmanager&mode=unit...
