CVE-2023-27757: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary code via a crafted JPG file...

CVE-2023-1407: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/user/manageuser.php. The manipulation of the argument id leads to sql injection. The attack can be...

CVE-2023-27589 Minio vulnerable to denial of access by an admin privileged user for root credential

Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with consoleAdmin permissions can potentially create a user that matches the root credential accessKey. Once this user is created successfully, the root...

CVE-2023-1395

A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been declared as problematic. This vulnerability affects the function query of the file admin/user/list.php. The manipulation of the argument name leads to cross site scripting. The attack can be initiated...

CVE-2023-1395

A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been declared as problematic. This vulnerability affects the function query of the file admin/user/list.php. The manipulation of the argument name leads to cross site scripting. The attack can be initiated...

CVE-2023-1395

CVE-2023-1395 affects SourceCodester Yoga Class Registration System 1.0. The issue is in the admin/user/list.php query function: manipulating the name parameter leads to cross-site scripting. Exploitation can be remote and has been disclosed publicly. Connected sources note practical mitigations ...

CVE-2023-27270

SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a class for test purposes in which an attacker authenticated as a non-administrative user can craft a request with certain...

CVE-2023-25618

SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in an unused class for error handling in which an attacker authenticated as a non-administrative user can craft a request with...

Design/Logic Flaw

SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a class for test purposes in which an attacker authenticated as a non-administrative user can craft a request with certain...

Atlassian Jira < 6.0.5 Multiple Vulnerabilities

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 6.0.5. It is, therefore, affected by multiple vulnerabilities: - A directory traversal in the Importers Plugin which permits remote attackers to create arbitrary files...

CVE-2023-1395: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been declared as problematic. This vulnerability affects the function query of the file admin/user/list.php. The manipulation of the argument name leads to cross site scripting. The attack can be initiated...

PT-2023-16952 · Sourcecodester · Sourcecodester Yoga Class Registration System

Name of the Vulnerable Software and Affected Versions: SourceCodester Yoga Class Registration System version 1.0 Description: A vulnerability was found in the SourceCodester Yoga Class Registration System. It affects the function query of the file admin/user/list.php. The manipulation of the name...

CVE-2023-25223

CRMEB =1.3.4 is vulnerable to SQL Injection via /api/admin/user/list...

Zhongbang CRMEB SQL注入漏洞

Zhongbang CRMEB is an open source e-commerce management system from Zhongbang in Xi'an, China. A security vulnerability exists in CRMEB version 1.3.4 and earlier versions, which originated from an SQL injection attack via /api/admin/user/list...

CVE-2023-25223: Improper Neutralization of Special Elements used in an SQL Command

CRMEB =1.3.4 is vulnerable to SQL Injection via /api/admin/user/list...

CVE-2023-25223

CRMEB =1.3.4 is vulnerable to SQL Injection via /api/admin/user/list...

CVE-2023-25223

CRMEB =1.3.4 is vulnerable to SQL Injection via /api/admin/user/list...

Stored Cross-site Scripting (XSS)

github.com/grafana/grafana is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to map attributes in the Geomap plugin which library does not properly sanitize, allowing an attacker with an editor role to inject and execute malicious JavaScript. If an admin user clicks on the m...

Music Gallery Site 1.0 Privilege Escalation / Missing Authentication Vulnerabilities

Music Gallery Site - Broken Access Control leads to compromise of complete application by adding admin user without log-in into the application. CVE Assigned: CVE-2023-0963 mitre.org nvd.nist.org Author Email: email protected Vendor Homepage: https://www.sourcecodester.com Software Link: Music...

Auto Dealer Management System 1.0 SQL Injection Vulnerability

Auto Dealer Management System - SQL Injection on page viewtransaction.php and parameter is id, application url is ?page=vehicles/viewtransaction&id=? with low privilege authentication CVE Assigned: CVE-2023-0912 mitre.org nvd.nist.org Author Name: Muhammad Navaid Zafar Ansari Author Email:...