Privilege Escalation

intelliants/subrion is vulnerable to privilege escalation. The vulnerability is due to improper access control in the built-in “Run SQL Query” feature under the SQL Tool admin panel, which allows authenticated administrators or moderators to execute arbitrary SQL commands and gain escalated...

CVE-2025-57567

A remote code execution RCE vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory /themes/defaut/css/minify.php. An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel,...

CVE-2025-62414

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature in the admin panel is vulnerable to Cross-Site Scripting XSS. An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields...

EUVD-2025-34903

ezsystems/ezplatform-admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal...

UBUNTU-CVE-2025-57567

A remote code execution RCE vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory /themes/defaut/css/minify.php. An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel,...

CVE-2025-57567

The CVE-2025-57567 entry concerns PluXml CMS. A vulnerability in the default theme’s minify.php (path: /themes/defaut/css/minify.php) can be triggered by an authenticated administrator who overwrites the file with arbitrary PHP code via the admin panel, enabling remote code execution (system comm...

PluXml 安全漏洞

PluXml is a free open source content management system from PluXml Open Source that does not require a database to work. A security vulnerability exists in PluXml that stems from a minify.php file in the default theme directory that allows administrators to override arbitrary PHP code via the adm...

CVE-2025-57567

A remote code execution RCE vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory /themes/defaut/css/minify.php. An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel,...

CVE-2025-57567

A remote code execution RCE vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory /themes/defaut/css/minify.php. An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel,...

Ivanti Endpoint Manager Mobile 12.6.0.x < 12.6.0.2 / 12.5.0.x < 12.5.0.4 / 12.x < 12.4.0.4 Multiple Vulnerabilities

The version of Ivanti Endpoint Manager Mobile, formerly MobileIron Core, running on the remote host is 12.6.0.x prior to 12.6.0.2, 12.5.0.x prior to 12.5.0.4, or 12.x prior to 12.4.0.4. It is, therefore, affected by multiple vulnerabilities: - OS command injection in the admin panel allows a remo...

GHSA-R9XJ-MVQF-JM7W bagisto has Cross Site Scripting (XSS) in Create New Customer

Summary In Bagisto v2.3.7, the “Create New Customer” feature in the admin panel is vulnerable to reflected / stored Cross-Site Scripting XSS. An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields. These payloads may later...

CVE-2025-62423

ClipBucket V5 contains a Blind SQL Injection in the Admin Area, specifically in /admin_area/login_as_user.php, affecting 5.5.2 and earlier. Exploitation requires Admin Area privileges. Root cause is a blind SQL injection vulnerability in the login_as_user workflow. Impact per sources is high/part...

CVE-2025-62414 bagisto - Cross Site Scripting (XSS) in Create New Customer

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature in the admin panel is vulnerable to Cross-Site Scripting XSS. An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields...

CVE-2025-62414 bagisto - Cross Site Scripting (XSS) in Create New Customer

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature in the admin panel is vulnerable to Cross-Site Scripting XSS. An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields...

CVE-2025-62414

Bagisto v2.3.7 contains a Cross-Site Scripting (XSS) vulnerability in the admin "Create New Customer" form. The issue arises from insufficient sanitization/escaping of input fields, allowing injected JavaScript to execute in an admin or viewer’s browser when customer data is displayed. The vulner...

CVE-2025-62414 bagisto - Cross Site Scripting (XSS) in Create New Customer

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature in the admin panel is vulnerable to Cross-Site Scripting XSS. An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields...

CVE-2025-10242

OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2025-10243

OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2025-10986

Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to write data in unintended locations on disk...

CVE-2025-10985

OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution...