2947 matches found
CVE-2023-1947: Improper Control of Generation of Code
A vulnerability was found in taoCMS 3.0.2. It has been classified as critical. Affected is an unknown function of the file /admin/admin.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used...
CVE-2023-26784
SQL Injection vulnerability found in Kirin Fortress Machine v.1.7-2020-0610 allows attackers to execute arbitrary code via the /admin.php?controller=admincommonuser parameter...
CVE-2015-10095
A vulnerability classified as problematic has been found in woo-popup Plugin up to 1.2.2 on WordPress. This affects an unknown part of the file admin/class-woo-popup-admin.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.3...
PT-2023-12261
Name of the Vulnerable Software and Affected Versions VICIdial versions 2.10-415c through 2.14-610c Description A Cross Site Scripting issue allows attackers to execute arbitrary code via the "/agc/vicidial.php", "agc/vicidial-greay.php", and "/vicidial/KHOMP admin.php" API endpoints. The...
CVE-2015-10095: Improper Neutralization of Input During Web Page Generation
A vulnerability classified as problematic has been found in woo-popup Plugin up to 1.2.2 on WordPress. This affects an unknown part of the file admin/class-woo-popup-admin.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.3...
CVE-2023-1045: Relative Path Traversal
A vulnerability was found in MuYuCMS 2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin.php/accessory/filesdel.html. The manipulation of the argument filedelur leads to relative path traversal. The attack may be launched remotely. The...
CVE-2021-34167
Cross Site Request Forgery CSRF vulnerability in taoCMS 3.0.2 allows remote attackers to gain escalated privileges via taocms/admin/admin.php...
PT-2023-12248
Name of the Vulnerable Software and Affected Versions taoCMS version 3.0.2 Description A Cross Site Request Forgery CSRF issue allows remote attackers to gain escalated privileges via the "taocms/admin/admin.php" endpoint. This can be exploited to perform unauthorized actions. Recommendations For...
CVE-2021-34167: Cross-Site Request Forgery (CSRF)
Cross Site Request Forgery CSRF vulnerability in taoCMS 3.0.2 allows remote attackers to gain escalated privileges via taocms/admin/admin.php...
CVE-2023-0840
A vulnerability classified as problematic was found in PHPCrazy 1.1.1. This vulnerability affects unknown code of the file admin/admin.php?action=users&mode=info&user=2. The manipulation of the argument username leads to cross site scripting. The attack can be initiated remotely. The exploit has...
CVE-2023-0840: Improper Neutralization of Input During Web Page Generation
A vulnerability classified as problematic was found in PHPCrazy 1.1.1. This vulnerability affects unknown code of the file admin/admin.php?action=users&mode=info&user=2. The manipulation of the argument username leads to cross site scripting. The attack can be initiated remotely. The exploit has...
Clickjacking
cockpit-hq is vulnerable to Clickjacking. The vulnerability exists due to the lack of the x-frame-options header in admin.php which allows an attacker to misdirect the user, making them click something unintentionally...
Stored XSS via blog author parameter on admin.php?p=config
Description The blog author parameter is unsanitized on the page admin.php?p=config. In this way is possible to inject arbitrary javascript code Proof of Concept - Login as regular user - Go to http://localhost/flatpress/admin.php?p=config - Set as blog author "alertdocument.domain - Refresh page...
Cross site scripting
A vulnerability was found in annyshow DuxCMS 2.1. It has been classified as problematic. This affects an unknown part of the file admin.php&r=article/AdminContent/edit of the component Article Handler. The manipulation of the argument content leads to cross site scripting. It is possible to...
CVE-2020-36609: Improper Neutralization
A vulnerability was found in annyshow DuxCMS 2.1. It has been classified as problematic. This affects an unknown part of the file admin.php&r=article/AdminContent/edit of the component Article Handler. The manipulation of the argument content leads to cross site scripting. It is possible to...
PT-2022-9011 · Unknown · Annyshow Duxcms
Name of the Vulnerable Software and Affected Versions: annyshow DuxCMS version 2.1 Description: A vulnerability was found in the file admin.php&r=article/AdminContent/edit of the component Article Handler. The manipulation of the content argument leads to cross-site scripting. It is possible to...
Cross site scripting
Web-Based Student Clearance System v1.0 was discovered to contain a cross-site scripting XSS vulnerability in Admin/add-admin.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtfullname parameter...
PT-2022-27444 · Unknown · Web-Based Student Clearance System
Name of the Vulnerable Software and Affected Versions: Web-Based Student Clearance System version 1.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtfullname parameter in the Admin/add-admin.php file. This enables the...
CVE-2022-45224: Improper Neutralization of Input During Web Page Generation
Web-Based Student Clearance System v1.0 was discovered to contain a cross-site scripting XSS vulnerability in Admin/add-admin.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtfullname parameter...
CVE-2022-45224
CVE-2022-45224 is an XSS vulnerability affecting the Web-Based Student Clearance System v1.0, with the flaw in Admin/add-admin.php where a crafted payload in the txtfullname parameter can execute arbitrary scripts/HTML. The connected sources confirm the issue but do not provide exploit details or...