PT-2022-13512

Name of the Vulnerable Software and Affected Versions Header Footer Code Manager WordPress plugin versions prior to 1.1.24 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the plugin does not properly escape generated URLs before outputting them back...

CVE-2022-0899: Improper Neutralization of Input During Web Page Generation

The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-34590

Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in /HMS/admin.php...

Hospital Management System SQL注入漏洞

The Hospital Management System HMS is a computer system that helps manage healthcare-related information and helps healthcare providers do their jobs efficiently. A security vulnerability exists in version 1.0 of the Hospital Management System that originates from an SQL injection in the editid...

CVE-2022-2001

The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce protection on the dxssadminpage function found in the /dx-share-selection.php file. This makes it possible for unauthenticated attackers to...

CVE-2022-30624

Browsing the admin.html page allows the user to reset the admin password. Also appears in the JS code for the password...

Code injection

Browsing the admin.html page allows the user to reset the admin password. Also appears in the JS code for the password...

WordPress plugin DX Share Selection 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

CVE-2022-30624

Browsing the admin.html page allows the user to reset the admin password. Also appears in the JS code for the password...

CVE-2022-1220: Improper Neutralization of Input During Web Page Generation

The FoxyShop WordPress plugin before 4.8.2 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

PT-2022-13723

Name of the Vulnerable Software and Affected Versions FoxyShop WordPress plugin versions prior to 4.8.2 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in an admin page...

CVE-2021-35283

SQL Injection vulnerability in productadmin.php in atoms183 CMS 1.0, allows attackers to execute arbitrary commands via the Name, Fname, and ID parameters to search.php...

CVE-2022-34814

Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view an administrative configuration page listing pending requests...

PT-2022-22366 · Jenkins · Jenkins Request Rename/Delete Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Request Rename Or Delete Plugin versions 1.1.0 and earlier Description: The issue arises from an incorrect permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view an administrative configuration...

CVE-2022-31063

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.111 the title of a document is not properly escaped in the search result of MyDocmanSearch widget and in the administration page of the locked documents. A malicious...

PT-2022-3300 · Trueconf · Trueconf Server

Name of the Vulnerable Software and Affected Versions: TrueConf Server version 4.3.7 Description: The issue is related to the failure to neutralize script-related HTML tags on the /admin/group/list/ webpage of the TrueConf Server software. This can allow a remote attacker to perform cross-site...

Online Railway Reservation System SQL注入漏洞

Sourcecodester Online Railway Reservation system is a web-based application that provides an online platform for rail or train station passengers or would-be passengers to view their schedules and reserve seats. Online Railway Reservation System v1.0 version contains a SQL injection vulnerability...

Prison Management System SQL注入漏洞

Prison Management System is a prison management system from Carlo Montero's personal developer. v1.0 of Prison Management System is vulnerable to SQL injection, which originates from the application /pms/admin/prisons/manageprison. php in the id parameter lack of SQL data filter escaping, an...

CVE-2022-33049

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/?page=user/manageuser...

ZZCMS SQL Injection Vulnerability (CNVD-2022-58309)

ZZCMS is a content management system CMS by the ZZCMS team in China. A security vulnerability exists in ZZCMS 2019 version, which can be exploited by an attacker to perform a SQL injection attack via the id parameter in /admin/showbad.php...