CVE-2019-9884: Improper Access Control

eClass platform ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page...

Facebook Messenger Customer Chat Plugin - Critical - Access bypass - SA-CONTRIB-2019-059

The Facebook Messenger Customer Chat Plugin module enables you to add the Facebook Messenger Customer Chat Plugin to your Drupal site. The module doesn't require user permissions on the admin page...

Default credentials

LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the customlogo filename suffix is not restricted, and .php may be used...

CVE-2018-17147

Nagios XI before 5.5.4 has XSS in the auto login admin management page...

CVE-2018-17147

Nagios XI before 5.5.4 has XSS in the auto login admin management page...

CVE-2018-17147

Nagios XI before 5.5.4 has XSS in the auto login admin management page...

PT-2019-13275

Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description A stored XSS issue was discovered in the content box of mc-admin/page-edit.php, which can be exploited to obtain a user's cookie. Recommendations For MiniCMS version 1.10, consider disabling the editing...

CVE-2019-13339: Improper Neutralization of Input During Web Page Generation

In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php content box, which can be used to get a user's cookie...

Watu Quizz <= 3.1.2.5 - Reflected XSS via question-form.html.php

The Watu Quiz WordPress plugin was affected by a Reflected XSS via question-form.html.php security vulnerability. /wp-admin/admin.php?page=watuquestion&question=1&action=edit&quiz=1"...

Sql injection

FreePBX 13 and 14 has SQL Injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page...

CVE-2013-7472: Improper Neutralization of Input During Web Page Generation

The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpdmetaboxes daytoshow parameter...

PT-2019-7021

Name of the Vulnerable Software and Affected Versions Count per Day plugin versions prior to 3.2.6 Description The issue allows for XSS exploitation via the daytoshow parameter in the /wp-admin/?page=cpd metaboxes API endpoint. Recommendations For versions prior to 3.2.6, update to version 3.2.6 ...

CVE-2018-18872

The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the eventtitle parameter in a wp-admin/admin.php?page=calendar add action, or the category name during category creation at the wp-admin/admin.php?page=calendar-categories URI...

CVE-2019-11567

An issue was discovered in AikCms v2.0. There is a SQL Injection vulnerability via $GET'del', as demonstrated by an admin/page/system/nav.php?del= URI...

CVE-2019-11568

An issue was discovered in AikCms v2.0. There is a File upload vulnerability, as demonstrated by an admin/page/system/nav.php request with PHP code in a .php file with the application/octet-stream content type...

PT-2019-12385

Name of the Vulnerable Software and Affected Versions AikCms version 2.0 Description An issue was discovered in AikCms, where there is a SQL Injection vulnerability. This can be exploited via the del variable in the $ GET request, as demonstrated by accessing the /admin/page/system/nav.php endpoi...

Okadminfinder3 - Admin Panel Finder / Admin Login Page Finder

OKadminFinder is an Apache2 Licensed utility, rewritten in Python 3.x , for admins/pentesters who want to find admin panel of a website. There are many other tools but not as effective and secure. Yeah, Okadminfinder has the the ability to use tor and hide your identity. Requirements Linux sudo a...

Cross-Site Scripting

Overview All versions of harp are vulnerable to Cross-Site Scripting. In the admin page it is possible to inject arbitrary JavaScript as a new product option, allowing attackers to execute arbitrary code. This is limited to the admin page and does not affect other pages. Recommendation No fix is...

HYBBS Cross-Site Request Forgery Vulnerability

HYBBS is a lightweight community forum program. A cross-site request forgery vulnerability exists in the /?admin/user.html page in HYBBS version 2.2, which originates from a WEB application that does not adequately validate whether a request is from a trusted user. An attacker could exploit this...

CVE-2019-9058

An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the selgroups parameter that leads to authenticated object injection...