5036 matches found
CVE-2022-36433
The CVE-2022-36433 entry concerns Amasty Blog Pro for Magento 2 (version 2.10.3) where the blog-post creation functionality permits JavaScript injection in the short_content and full_content fields, enabling XSS against admin users via posts/preview or posts/save. Root cause is unfiltered content...
CVE-2022-45224
Web-Based Student Clearance System v1.0 was discovered to contain a cross-site scripting XSS vulnerability in Admin/add-admin.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtfullname parameter...
CVE-2022-36432
The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks on admin panel users by manipulating the generated preview application response...
Cross site scripting
The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks on admin panel users by manipulating the generated preview application response...
PT-2022-23366 · Amasty +1 · Amasty Blog Pro +1
Name of the Vulnerable Software and Affected Versions: Amasty Blog Pro version 2.10.3 Description: The Preview functionality in the Amasty Blog Pro plugin for Magento 2 uses eval unsafely, allowing attackers to perform Cross-site Scripting attacks on admin panel users by manipulating the generate...
PT-2022-26301 · Hustoj · Hustoj
Name of the Vulnerable Software and Affected Versions: Hustoj version 22.09.22 Description: The issue is related to a XSS vulnerability in the /admin/problem judge.php endpoint. Recommendations: For Hustoj version 22.09.22, consider restricting access to the /admin/problem judge.php endpoint unti...
CVE-2022-36432
The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks on admin panel users by manipulating the generated preview application response...
PostmagThemes Demo < 1.0.8 - Admin+ Arbitrary File Upload
The plugin does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files such as PHP leading to RCE. 1. Go to Appearance » Import Demo Data » Manual demo files upload » Run "Choose a JSON file for customizer import" and import a PHP file. 2. Click Impo...
Exploit for Use of Hard-coded Credentials in Pctechsoft Pcsecure
PCSecure V5.0.8.xw - Use of Hard-coded Credentials in configur...
Design/Logic Flaw
An arbitrary file upload vulnerability in admin-add-vehicle.php of Vehicle Booking System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...
DotNetNuke Administration Panel Login Form Detected
DotNetNuke Administration Panel login has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative...
CVE-2022-37202
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list...
CVE-2022-42176
In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access...
CVE-2022-42176
In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access...
Hardcoded credentials
In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access...
CVE-2022-42176
In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access...
PT-2022-26299 · Pctechsoft · Pcsecure
Name of the Vulnerable Software and Affected Versions: PCTechSoft PCSecure version 5.0.8.xw Description: The issue is related to the use of hard-coded credentials in configuration files, which can lead to unauthorized access to the admin panel. Recommendations: For PCTechSoft PCSecure version...
CVE-2022-42176
PCSecure V5.0.8.xw by PCTechSoft is affected by hard-coded credentials in configuration files, allowing local access to the admin panel. The linked exploit/documentation shows credentials stored in a plaintext system.bmp within the configuration, enabling a local user to log in as administrator. ...
