CVE-2020-25273

CVE-2020-25273 Online Bus Booking System 1.0, there is Authentication bypass on the Admin Login screen in admin.php via username or password SQL injection. Vendor - SourceCodester Product -https://www.sourcecodester.com/php/14438/online-bus-booking-system-project-using-phpmysql.html V 1.0...

CVE-2024-39248

Exploit Title: SimpCMS v0.1 - Cross Site Scripting XSS CVE: CVE-2024-39248 Exploit Author: Jason Jacobs 0xjasonjacobs - Twitter Vendor Homepage: https://sourceforge.net/projects/simpcms/ Vulnerable endpoint: /SimpCMS/admin.php A cross-site scripting XSS vulnerability in SimpCMS v0.1 allows...

CVE-2022-27413

Hospital-Management-System v1.0 - SQL 注入 厂商 描述： 存在漏洞的页面是 admin.php http://you ip/HMS/admin.php Hospital-Management-System v1.0 admin.php 页面中的 adminname 参数似乎容易受到 SQL 注入攻击。 +sqlmap: python3 sqlmap.py -r Your post packet.txt --random-agent --risk=3 --level=3 -dbs + Payloads: root@kitploit: Parameter...

CVE-2026-38192

pluck-CMS-4.7.20-code-injection-vulnerability 在 admin.php 中，moduleaddtosite 函数会遍历整个 $POST 数组，使用 explode'|', ... 分割用户可控的参数名，并将其直接拼接进 data/settings/themes//moduleconf.php 文件中。该文件随后会被包含到后台页面和前端 themearea 渲染过程中。由于参数名未经过白名单验证和安全转义，攻击者可以污染可执行的 PHP 文件，从而导致代码注入漏洞。 项目地址：https://github.com/pluck-cms/pluck/...

CVE-2009-4623

CVE-2009-4623 Remote shell on CVE-2009-4623: Get a non-interactive shell, open another shell for an advanced use !!! usage: CVE-2009-4623.sh hostnameandPath example: CVE-2009-4623.sh http://192.168.1.24/advancedcommentsystem/admin.php options: -h this cruft...

CVE-2025-57310

CVE-2025-57310 A Cross-Site Request Forgery CSRF vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allowing attackers to execute arbitrary code. CWE CWE-352: Cross-Site Request Forgery CSRF CVSS v3.1 Base Score: 8.8 High root@kitploit:...

CVE-2026-86670 aircheng-org iWebShop-5 Authentication Storage admin.php weak password hash

A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the component Authentication Storage. Executing a manipulation of the argument Password can lead to password hash with insufficient computational effort. It is possib...

CVE-2026-86670

aircheng-org iWebShop-5 versions up to 5.15 contain a vulnerability in the Authentication Storage component within the file controllers/admin.php . Manipulating the Password argument can result in a password hash with insufficient computational effort , effectively weakening credential protection...

CVE-2026-86670 aircheng-org iWebShop-5 Authentication Storage admin.php weak password hash

A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the component Authentication Storage. Executing a manipulation of the argument Password can lead to password hash with insufficient computational effort. It is possib...

CVE-2026-63302

Quick.CMS is vulnerable to Local File Inclusion LFI in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure...

CVE-2016-20070

WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize input parameters. Attackers with...

EUVD-2019-20182

WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint with action=duplicatequoteinvoice and...

PT-2026-49225

WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint with action=duplicate quote invoice an...

CVE-2026-11480

A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. Impacted is an unknown function of the file beike/Admin/Routes/admin.php of the component Admin Design Builder Endpoint. Performing a manipulation of the argument settings.value results in sql injection. I...

CVE-2026-9609

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9609 QianFox FoxCMS Admin.php edit password recovery

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

EUVD-2026-32029

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-8626

CVE-2026-8626 concerns the SponsorMe WordPress plugin, vulnerable to Reflected Cross-Site Scripting via the PHP_SELF parameter in all versions up to 0.5.2. The issue arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts int...

CVE-2020-37246

Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. Attackers can modify the download parameter in admin.php requests with directory traversal sequences to access...

CVE-2020-37246

Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. Attackers can modify the download parameter in admin.php requests with directory traversal sequences to access...