2780 matches found
CVE-2024-31545
Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/?page=user/manageuser&id=6...
CVE-2024-31545
Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/?page=user/manageuser&id=6...
CVE-2024-31545: Improper Neutralization of Special Elements used in an SQL Command
Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/?page=user/manageuser&id=6...
PT-2024-27520 · Unknown · Cym1102 Nginxwebui
Name of the Vulnerable Software and Affected Versions: cym1102 nginxWebUI versions up to 3.9.9 Description: A critical issue has been found in the function exec of the file /adminPage/conf/reload. The manipulation of the argument nginxExe leads to deserialization. The attack may be initiated...
PT-2024-27503 · Unknown · Cym1102 Nginxwebui
Name of the Vulnerable Software and Affected Versions: cym1102 nginxWebUI versions up to 3.9.9 Description: A critical issue affects the function findCountByQuery of the file /adminPage/www/addOver. The manipulation of the argument dir leads to path traversal. This issue can be exploited remotely...
CVE-2024-31986 XWiki Platform CSRF remote code execution through scheduler job's document reference
XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, by creating a document with a special crafted documented reference and an XWiki.SchedulerJobClass XObject, it is possible to execute arbitrary code on the server whenever an...
CVE-2024-31506
Sourcecodester Online Graduate Tracer System v1.0 is vulnerable to SQL Injection via the "id" parameter in admin/admincs.php...
CVE-2024-31506
Sourcecodester Online Graduate Tracer System v1.0 is vulnerable to SQL Injection via the "id" parameter in admin/admincs.php...
CVE-2024-3437
A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /Admin/add-admin.php of the component Avatar Handler. The manipulation of the argument avatar leads to unrestricted upload. The attack ma...
Prison Management System 代码问题漏洞
Prison Management System is a prison management system. A file upload vulnerability exists in Prison Management System version 1.0, which stems from a lack of validation of uploaded files in the avatar parameter of the /Admin/add-admin.php file. This vulnerability can be exploited to remotely...
CVE-2024-3422
CVE-2024-3422 affects SourceCodester Online Courseware 1.0. The vulnerability is an SQL injection in the file admin/activatestud.php caused by unsafely manipulating the selector argument. It can be exploited remotely and has been publicly disclosed (VDB-259594). Several connected sources concur o...
CVE-2024-30849
Arbitrary file upload vulnerability in Sourcecodester Complete E-Commerce Site v1.0, allows remote attackers to execute arbitrary code via filename parameter in admin/productsphoto.php...
PT-2024-25306 · Sourcecodester · Sourcecodester Aplaya Beach Resort Online Reservation System
Name of the Vulnerable Software and Affected Versions: SourceCodester Aplaya Beach Resort Online Reservation System version 1.0 Description: A critical issue has been found, affecting an unknown function of the file admin/mod users/index.php. The manipulation of the id argument leads to SQL...
CVE-2024-30248 Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page
Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin...
CVE-2024-30248 Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page
Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin...
CVE-2024-30867
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/editvirtualsiteinfo.php...
CVE-2024-30859
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/configISCGroupSSLCert.php...
CVE-2024-30858
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/editfirewall.php...