Design/Logic Flaw

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users from:users-permissions. There are many scenarios in whic...

Design/Logic Flaw

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship e.g., created by, updated by with content accessible to the authenticated user. For example, a...

CVE-2022-30618

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users from:users-permissions. There are many scenarios in whic...

CVE-2022-30618

The CVE-2022-30618 entry describes a vulnerability in Strapi where an authenticated user with access to the Strapi admin panel can view private data (e.g., email, password reset tokens) of API users when content types have relationships to API users (from: users-permissions). The leak occurs in J...

CVE-2022-30617

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship e.g., created by, updated by with content accessible to the authenticated user. For example, a...

CVE-2022-30617

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship e.g., created by, updated by with content accessible to the authenticated user. For example, a...

CVE-2022-30617

The CVE-2022-30617 issue affects Strapi where an authenticated admin-panel user can read private data (e.g., emails, password reset tokens) for other admin users via related content in the JSON response. This leakage occurs across relationships (e.g., content created/updated by another user) and ...

Strapi 安全漏洞

Strapi is an open source content management system CMS. A security vulnerability exists in Strapi versions 3.0 prior to 3.6.9 and 4.0 prior to 4.1.9, which stems from the fact that details from API users may be leaked into JSON responses in the admin panel through a direct or indirect relationshi...

Strapi 安全漏洞

Strapi is an open source content management system CMS. A security vulnerability in Strapi version 3.0 prior to version 3.6.9 and version 4.0 prior to version 4.0.0-beta.15 arises from a vulnerability in which an authenticated user with access to the Strapi admin panel can view private and...

The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request

POC: 1. go to signup form: http://127.0.0.1:8118/signup 2. Fill the Full Name input field with huge charactersmore than lakhs or crores 3. After created the account, check the admin panel: http://127.0.0.1:8118/accounts, go to Accounts -- customers 4. The admin panel will be flooded with our...

GHSA-QGRF-34HP-GHM9 OpenCart Path Traversal

OpenCart through 3.0.2.0 allows directory traversal in the editDownload function in admin\model\catalog\download.php via admin/index.php?route=catalog/download/edit, related to the downloadid. For example, an attacker can download ../../config.php...

Subrion Cross-site Scripting (XSS)

There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration...

GHSA-9738-C49Q-4RGC Subrion Cross-site Scripting (XSS)

There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration...

CVE-2022-30373

Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/cargotypes/managecargotype.php?id=...

Dolibarr arbitrary commands execution

The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads...

GHSA-6J62-M2VV-WC3M Dolibarr arbitrary commands execution

The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads...

Cyber Cafe Management System SQL Injection Vulnerability

Cyber Cafe Management System CCMS is an Internet cafe management system. version 1.0 of Cyber Cafe Management System Project is vulnerable to SQL injection, which stems from multiple SQL injection vulnerabilities in the username and password parameters in the administration panel. An attacker cou...

Merchandise Online Store SQL注入漏洞

Merchandise Online Store is a merchandise online store system. merchandise Online Store has a security vulnerability that can be exploited by attackers via /vloggersmerch/admin/?page=maintenance/managecategory& id= to conduct an SQL injection attack...

CVE-2022-29009

Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Management System Project v1.0 allows attackers to bypass authentication...

CVE-2022-29009

Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Management System Project v1.0 allows attackers to bypass authentication...