WordPress plugin Pedalo Connector 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-9002: Improper Privilege Management

CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiality, integrity, and availability of the workstation when non-admin authenticated user tries to perform privilege escalation by tampering with the binaries...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity

EN GenTeamCityExploit is a PoC tool that targets a vulnera...

CVE-2024-43363 Remote code execution via Log Poisoning in Cacti

Cacti is an open source performance and fault management framework. An admin user can create a device with a malicious hostname containing php code and repeat the installation process completing only step 5 of the installation process is enough, no need to complete the steps before or after it to...

CVE-2024-43363

Cacti is an open source performance and fault management framework. An admin user can create a device with a malicious hostname containing php code and repeat the installation process completing only step 5 of the installation process is enough, no need to complete the steps before or after it to...

PT-2024-6665 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.28 Description: The issue is related to incorrect code generation management in the Cacti network monitoring tool. An admin user can create a device with a malicious hostname containing PHP code, allowing for log...

CVE-2024-43363: Improper Control of Generation of Code

Cacti is an open source performance and fault management framework. An admin user can create a device with a malicious hostname containing php code and repeat the installation process completing only step 5 of the installation process is enough, no need to complete the steps before or after it to...

PT-2024-31856 · Zenario · Zenario

Name of the Vulnerable Software and Affected Versions: Zenario version 9.7.61188 Description: The issue allows authenticated admin users to upload PDF files containing malicious code into the target system. If the PDF file is accessed through the website, it can trigger a Cross Site Scripting XSS...

CVE-2024-46394

FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery CSRF via /admin/?/user/add...

Exploit for Cross-Site Request Forgery (CSRF) in Creativeitem Academy_Lms

CVE-2022-47132 Academy LMS = 5.10 CSRF Description Acad...

CVE-2024-46394

FrogCMS v0.9.5 is affected by a CSRF vulnerability via /admin/?/user/add. CVE-2024-46394 impacts FrogCMS 0.9.5 with a root cause allowing unauthorized actions through cross-site requests. CVSS v3.1 scores indicate High impact: NVD lists 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with network attac...

CVE-2024-46394: Cross-Site Request Forgery (CSRF)

FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery CSRF via /admin/?/user/add...

CVE-2024-8306: Improper Privilege Management

CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiality, integrity and availability of the workstation when non-admin authenticated user tries to perform privilege escalation by tampering with the binaries...

CVE-2024-44112

Due to missing authorization check in SAP for Oil & Gas Transportation and Distribution, an attacker authenticated as a non-administrative user could call a remote-enabled function which will allow them to delete non-sensitive entries in a user data table. There is no effect on confidentiality or...

CVE-2024-44112

Due to missing authorization check in SAP for Oil & Gas Transportation and Distribution, an attacker authenticated as a non-administrative user could call a remote-enabled function which will allow them to delete non-sensitive entries in a user data table. There is no effect on confidentiality or...

CVE-2024-44112 Missing Authorization check in SAP for Oil & Gas (Transportation and Distribution)

Due to missing authorization check in SAP for Oil & Gas Transportation and Distribution, an attacker authenticated as a non-administrative user could call a remote-enabled function which will allow them to delete non-sensitive entries in a user data table. There is no effect on confidentiality or...

PHPGurukul Job Portal SQL注入漏洞

PHPGurukul Job Portal is a PHP-based job search website system from PHPGurukul. A SQL injection vulnerability exists in PHPGurukul Job Portal version 1.0, which originates from the userid parameter in /jobportal/admin/user/controller.php...

CVE-2024-8465: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability, by which an attacker could send a specially designed query through userid parameter in /jobportal/admin/user/controller.php, and retrieve all the information stored in it...

CVE-2024-43797

audiobookshelf is a self-hosted audiobook and podcast server. A non-admin user is not allowed to create libraries or access only the ones they have permission to. However, the LibraryController is missing the check for admin user and thus allows a path traversal issue. Allowing non-admin users to...

CVE-2024-43801 Privilege escalation to admin from a low-privileged user via SVG upload in Jellyfin

Jellyfin is an open source self hosted media server. The Jellyfin user profile image upload accepts SVG files, allowing for a stored XSS attack against an admin user via a specially crafted malicious SVG file. When viewed by an admin outside of the Jellyfin Web UI e.g. via "view image" in a...