CVE-2024-42612

Pligg CMS v2.0.2 is affected by a CSRF vulnerability that can be triggered through /admin/domain_management.php?whitelist_add. The root cause is insufficient verification of the request origin trusted user, enabling an attacker to forge malicious actions. Documented impact includes the ability to...

Build Your Own Botnet 2.0.0 Remote Code Execution

Exploit Title: BYOB Build Your Own Botnet v2.0.0 Unauthenticated RCE Remote Code Execution Date: 2024-08-14 Exploit Author: @chebuya Software Link: https://github.com/malwaredllc/byob Version: v2.0.0 Tested on: Ubuntu 22.04 LTS, Python 3.10.12, change numpy==1.17.3-numpy CVE: CVE-2024-?????,...

CVE-2024-7593

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel...

CVE-2024-7593

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel...

Farmacia Gama 1.0 Farmacia Gama 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Farmacia Gama v1.0 v1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64 bits | ...

Employee Management System 1.0 SQL Injection

============================================================================================================================================= | Title : Employee Management System v1.0 Auth By Pass Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox...

Blog Site 1.0 Cross Site Scripting

============================================================================================================================================= | Title : Blog Site 1.0 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64 bits | | Vendor :...

Exploit for Incorrect Comparison in Mailcow Mailcow\:_Dockerized

CVE-2024-41958-PoC This is a small proof of concept for CVE-...

CampCodes Supplier Management System 安全漏洞

Campcodes Supplier Management System is a supplier management system from Campcodes, Inc. A security vulnerability exists in CampCodes Supplier Management System version v1.0, which stems from an SQL injection vulnerability via SupplyManagementSystem/admin/viewinvoiceitems.php?id=...

CVE-2024-6942

A vulnerability, which was classified as problematic, was found in ThinkSAAS 3.7.0. Affected is an unknown function of the file app/system/action/anti.php of the component Admin Panel Security Center. The manipulation of the argument ip/email/phone leads to cross site scripting. It is possible to...

CVE-2024-6942 ThinkSAAS Admin Panel Security Center anti.php cross site scripting

A vulnerability, which was classified as problematic, was found in ThinkSAAS 3.7.0. Affected is an unknown function of the file app/system/action/anti.php of the component Admin Panel Security Center. The manipulation of the argument ip/email/phone leads to cross site scripting. It is possible to...

CVE-2024-6942

ThinkSAAS 3.7.0 Admin Panel Security Center contains a cross-site scripting flaw in file app/system/action/anti.php. Manipulating ip, email, or phone arguments can be exploited remotely; exploit has been disclosed publicly. Multiple connected sources confirm affected software and component. Pract...

CVE-2024-6942 ThinkSAAS Admin Panel Security Center anti.php cross site scripting

A vulnerability, which was classified as problematic, was found in ThinkSAAS 3.7.0. Affected is an unknown function of the file app/system/action/anti.php of the component Admin Panel Security Center. The manipulation of the argument ip/email/phone leads to cross site scripting. It is possible to...

PT-2024-37980 · Thinksaas · Thinksaas

Name of the Vulnerable Software and Affected Versions: ThinkSAAS version 3.7.0 Description: A problematic issue was found in the Admin Panel Security Center component, specifically in the file app/system/action/anti.php. The manipulation of the ip, email, or phone argument leads to cross-site...

WordPress Poll Maker 5.3.2 SQL Injection

Exploit Title: WordPress Poll Maker Plugin SQL Injection Date: 2024-07-11 Exploit Author: tmrswrr Category : Webapps Vendor: https://ays-pro.com/wordpress/poll-maker Version 5.3.2 1. Access the Admin Panel: - Navigate to the admin panel of your WordPress site. - Go to Poll Maker Results...

CVE-2024-27095 Decidim cross-site scripting (XSS) in the admin panel

Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1...

CVE-2024-27095 Decidim cross-site scripting (XSS) in the admin panel

Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1...

CVE-2024-27095 Decidim cross-site scripting (XSS) in the admin panel

Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization through the admin panel. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The...

GHSA-529P-JJ47-W3M3 Decidim cross-site scripting (XSS) in the admin panel

Impact The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. The attacker is able to change e.g. to if they know how to craft these requests themselves. And then enter the returned blob ID to the form inputs manually b...