CVE-2024-4483 Email Encoder < 2.2.2 - Admin+ Stored XSS

The Email Encoder WordPress plugin before 2.2.2 does not escape the WPEmailEncoderBundleoptionsprotectiontext parameter before outputting it back in an attribute in an admin page, leading to a Stored Cross-Site Scripting...

WordPress plugin Email Encoder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in th...

CVE-2024-37859

Cross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the page parameter to php-lfis/admin/index.php...

PT-2024-31271 · WordPress · Email Encoder

Name of the Vulnerable Software and Affected Versions: The Email Encoder WordPress plugin versions prior to 2.2.2 Description: The issue is related to a Stored Cross-Site Scripting problem. It occurs because the WP Email Encoder Bundle optionsprotection text parameter is not properly escaped befo...

CVE-2024-4483: Improper Neutralization of Input During Web Page Generation

The Email Encoder WordPress plugin before 2.2.2 does not escape the WPEmailEncoderBundleoptionsprotectiontext parameter before outputting it back in an attribute in an admin page, leading to a Stored Cross-Site Scripting...

PT-2024-38006 · Sourcecodester · Employee/Visitor Gate Pass Logging System

Name of the Vulnerable Software and Affected Versions: SourceCodester Employee and Visitor Gate Pass Logging System version 1.0 Description: A critical issue has been found in the system, affecting the file /employee gatepass/admin/?page=employee/manage employee. The manipulation of the id argume...

CVE-2024-40034

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/userLeveldeal.php?mudi=del...

CVE-2024-40039

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/userGroupdeal.php?mudi=del...

CVE-2024-40035

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/userLeveldeal.php?mudi=add...

CVE-2024-39020

The Net Titanium Technology idcCMS (Idc Cloud Management Proxy System) version 1.35 is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The flaw exists in the /admin/vpsApiData_deal.php endpoint, specifically when the mudi and nohrefStr parameters are set to rev and close, respectively. ...

CVE-2024-39248

A cross-site scripting XSS vulnerability in SimpCMS v0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field at /admin.php...

CVE-2024-39154

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/keyWorddeal.php?mudi=del&dataType=word&dataTypeCN...

CVE-2024-39153

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/infodeal.php?mudi=del&dataType=news&dataTypeCN...

CVE-2024-36528

nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/download.php and /admin/extensions/upload.php...

CVE-2024-36668

CVE-2024-36668 affects idccms v1.35, with a Cross-Site Request Forgery (CSRF) in the admin/type_deal.php?mudi=del component. The root cause is a CSRF in the admin endpoint, enabling unauthorized actions to be performed without user consent. The Red Hat/PT Security entry confirms a CSRF in the sam...

CVE-2024-36549

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via /admin/vpsCompanydeal.php?mudi=rev&nohrefStr=close...

CVE-2024-35350

A SQL injection vulnerability exists in Diño Physics School Assistant version 2.3 . The flaw originates from unrecognized code within the file /admin/?page=borrow/view_borrow , where manipulating the id argument allows for unauthorized database interaction. As a temporary workaround, it is recomm...

PT-2024-26449 · Unknown · Diño Physics School Assistant

Name of the Vulnerable Software and Affected Versions: Diño Physics School Assistant version 2.3 Description: A vulnerability has been discovered that impacts an unidentified code within the file "/admin/?page=borrow/view borrow". Manipulating the argument id can result in SQL injection...

F-logic DataCube3 安全漏洞

F-logic DataCube3 is a small measurement terminal system from F-logic Japan. A security vulnerability exists in F-logic DataCube3 v1.0, which originates from a command injection vulnerability in the file /admin/transceiverschedule.php...

CVE-2024-5385

A vulnerability, which was classified as problematic, has been found in oretnom23 Online Car Wash Booking System 1.0. This issue affects some unknown processing of the file /admin/?page=user/list. The manipulation of the argument First Name/Last Name with the input confirm document.cookie leads t...