5042 matches found
SOPlanning 1.52.00 Cross Site Request Forgery
/ !-- Update the following field to change the admins password to the...
SOPlanning 1.52.00 Cross Site Request Forgery Vulnerability
/...
The vulnerability of the update_form() function in the Admin Bar Editor plugin of the WordPress content management system allows a hacker to enable or disable the administrator panel on the website’s external interface.
The vulnerability of the updateform function in the Admin Bar Editor plugin of the WordPress content management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to enable or disable the administrator panel on the website’s...
CVE-2024-31547
Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/item/viewitem.php...
CVE-2024-22179
The application is vulnerable to an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving her access to the admin panel. Also vulnerable to account takeover and arbitrary password change...
CVE-2024-22179 Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data
The application is vulnerable to an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving her access to the admin panel. Also vulnerable to account takeover and arbitrary password change...
CVE-2024-22179 Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data
The application is vulnerable to an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving her access to the admin panel. Also vulnerable to account takeover and arbitrary password change...
CVE-2024-22179
CVE-2024-22179 affects Electrolink FM/DAB/TV Transmitter family (10W/100W/250W Compact DAB; 500W–30kW DAB; Compact FM; Modular FM; Digital FM; BI/BIII VHF; UHF TV). Root cause: unauthenticated parameter manipulation that lets an attacker set credentials to blank, gaining admin panel access and en...
Online Fire Reporting System 1.2 SQL Injection
Exploit Title: Online Fire Reporting System SQL Injection Authentication Bypass Date: 02/10/2024 Exploit Author: Diyar Saadi Vendor Homepage: https://phpgurukul.com/online-fire-reporting-system-using-php-and-mysql/ Software Link:...
VulnCheck KEV: CVE-2024-20767
Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel...
Virtuozzo Hybrid Infrastructure 6.1 Hotfix 1 (6.1.0-247)
In this release, Virtuozzo Hybrid Infrastructure enables selective updates of specific Kubernetes node groups, as well as provides stability and performance improvements. Vulnerability id: VSTOR-83526 Cannot filter backup plans by using the "Disabled" status. Vulnerability id: VSTOR-83662 Added...
CVE-2024-31204 mailcow Cross-site Scripting Vulnerability via Exception Handler
mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability resides in the exception handling mechanism, specifically when not operating in DEVMODE. The system saves...
CVE-2024-31204 mailcow Cross-site Scripting Vulnerability via Exception Handler
mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability resides in the exception handling mechanism, specifically when not operating in DEVMODE. The system saves...
CVE-2024-30248
Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin...
SVG Injection
piccoloadmin is vulnerable to SVG Injection. This vulnerability due to insufficient input validation and improper handling of SVG files within Piccolo's admin panel, allowing attackers to upload a malicious SVG file, which, when loaded under certain contexts, permits arbitrary access to the admin...
GL-iNet MT6000 4.5.5 Arbitrary File Download
Exploit Title: GL-iNet MT6000 4.5.5 - Arbitrary File Download CVE: CVE-2024-27356 Google Dork: intitle:"GL.iNet Admin Panel" Date: 2/26/2024 Exploit Author: Bandar Alharbi aggressor Vendor Homepage: www.gl-inet.com Tested Software Link:...
GL-iNet MT6000 4.5.5 - Arbitrary File Download
Exploit Title: GL-iNet MT6000 4.5.5 - Arbitrary File Download CVE: CVE-2024-27356 Google Dork: intitle:"GL.iNet Admin Panel" Date: 2/26/2024 Exploit Author: Bandar Alharbi aggressor Vendor Homepage: www.gl-inet.com Tested Software Link:...
GHSA-PMWW-V6C9-7P83 Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page
Summary Piccolo's admin panel provides the ability to upload media files and view them within the admin panel. If SVG is an allowed file type for upload; the default; an attacker can upload an SVG which when loaded under certain contexts allows for arbitrary access to the admin page. This access...
Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page
Summary Piccolo's admin panel provides the ability to upload media files and view them within the admin panel. If SVG is an allowed file type for upload; the default; an attacker can upload an SVG which when loaded under certain contexts allows for arbitrary access to the admin page. This access...