2775 matches found
CVE-2022-1694: Cross-Site Request Forgery (CSRF)
The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logged in admin to add, modify or delete banners from the plugin by submitting a form...
CVE-2022-1773: Improper Neutralization of Input During Web Page Generation
The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting...
CVE-2022-1532: Improper Neutralization of Input During Web Page Generation
Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...
Cross Site Scripting vulnerability in django-jsonform's admin form.
Description django-jsonform stores the raw JSON data of the db field in a hidden textarea on the admin page. However, that data was kept in the textarea after unescaping it using the safe template filter. This opens up possibilities for XSS attacks. This only affects the admin pages where the...
GHSA-X9JP-4W8M-4F3C Cross Site Scripting vulnerability in django-jsonform's admin form.
Description django-jsonform stores the raw JSON data of the db field in a hidden textarea on the admin page. However, that data was kept in the textarea after unescaping it using the safe template filter. This opens up possibilities for XSS attacks. This only affects the admin pages where the...
CVE-2017-20033
A vulnerability classified as problematic has been found in PHPList 3.2.6. This affects an unknown part of the file /lists/admin/. The manipulation of the argument page with the input send'";alert8 leads to cross site scripting Reflected. It is possible to initiate the attack remotely. Upgrading...
PT-2022-28290
Name of the Vulnerable Software and Affected Versions django-jsonform versions prior to 2.10.1 Description The issue allows for XSS attacks due to the storage of raw JSON data in a hidden textarea on the admin page, which is unescaped using the safe template filter. This affects admin pages where...
Elitecms SQL Injection Vulnerability (CNVD-2022-57759)
Elitecms is a Web content management from elitecms India. elitecms version 1.01 has a SQL injection vulnerability that originates from the lack of validation of external input SQL statements on the /admin/addpost.php page, which can be exploited by attackers to execute illegal SQL commands to ste...
Online Ordering System SQL Injection Vulnerability (CNVD-2022-55719)
Online Ordering System is a multi-store ordering system that can be used by any small business. version 1.0 of Online Ordering System is vulnerable to a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements on the admin/viewreport.php page, which...
School Dormitory Management System Cross-Site Scripting Vulnerability
School Dormitory Management System is a school dormitory management system. v1.0 of School Dormitory Management System has a cross-site scripting vulnerability that originates from admin/inc/navigation.php:125 page that lacks a filter for user The vulnerability is caused by a lack of checksum...
School Dormitory Management System Cross-Site Scripting Vulnerability (CNVD-2022-66661)
School Dormitory Management System is a school dormitory management system. v1.0 version of School Dormitory Management System has a cross-site scripting vulnerability that originates from admin/inc/navigation.php:126 page that lacks a filter for user The vulnerability is caused by a lack of...
Online Ordering System SQL Injection Vulnerability (CNVD-2022-55714)
Online Ordering System is a multi-store ordering system that can be used by any small business. version 1.0 of Online Ordering System is vulnerable to a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements on the admin/vieworders.php page, which...
Wedding Management System SQL Injection Vulnerability (CNVD-2022-54288)
Wedding Management System is a wedding planning management system by John Paul Lim Gabule, a personal developer. v1.0 of Wedding Management System is vulnerable to SQL injection, which originates from the admin/packageedit.php page that lacks The vulnerability is caused by a lack of validation of...
Online Ordering System SQL Injection Vulnerability (CNVD-2022-55715)
Online Ordering System is a multi-store ordering system that can be used by any small business. version 1.0 of Online Ordering System is vulnerable to a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements on the admin/editproductetails.php page,...
Elitecms SQL Injection Vulnerability (CNVD-2022-57764)
Elitecms is a web content management by elitecms India. elitecms version 1.01 has a SQL injection vulnerability, which originates from the /admin/editsidebar.php page page parameter lack of validation of external input SQL statements, an attacker can use this vulnerability to execute illegal SQL...
Wedding Management System SQL Injection Vulnerability (CNVD-2022-54287)
Wedding Management System is a wedding planning management system by John Paul Lim Gabule, a personal developer. v1.0 of Wedding Management System is vulnerable to SQL injection, which originates from the admin/logeventsedit.php page Lack of validation of external input SQL statements can be...
Elitecms SQL Injection Vulnerability (CNVD-2022-57763)
Elitecms is a Web content management by elitecms India. elitecms version 1.01 has a SQL injection vulnerability that originates from the admin/editpost.php page's lack of validation of external input SQL statements, which can be exploited by attackers to execute illegal SQL commands to steal...
Online Ordering System SQL Injection Vulnerability (CNVD-2022-55716)
Online Ordering System is a multi-store ordering system that can be used by any small business. version 1.0 of Online Ordering System is vulnerable to a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements on the admin/editproductimage.php page,...
Wedding Management System SQL Injection Vulnerability (CNVD-2022-54293)
Wedding Management System is a wedding planning management system by John Paul Lim Gabule, a personal developer. version 1.0 of Wedding Management System is vulnerable to SQL injection, which stems from a lack of validation of external input on the admin/usersedit.php page. SQL statement...