503 matches found
CVE-2021-44076
CrushFTP 9 is affected. The vulnerability arises when creating a new user via the "/WebInterface/UserManager/" interface, where an attacker with access to the administration panel can trigger Stored XSS. The payload may execute in scenarios such as when the user’s page appears in the Most Visited...
PT-2022-11976 · Crushftp · Crushftp
Name of the Vulnerable Software and Affected Versions: CrushFTP version 9 Description: An issue was discovered in the creation of a new user through the "/WebInterface/UserManager/" interface, allowing an attacker with access to the administration panel to perform Stored Cross-Site Scripting XSS...
CrushFTP 跨站脚本漏洞
CrushFTP is a file transfer server. A security vulnerability exists in CrushFTP version 9, which can be exploited by an attacker to execute stored cross-site scripting XSS by accessing the administration panel...
Nagios XI 跨站脚本漏洞
Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. A security vulnerability exists in Nagios XI version v5.8.6, which stems from the discovery of a cross-site...
MaianAffiliate Code Injection Vulnerability Vulnerability
MaianAffiliate is a free, simple but powerful php referral system written in PHP. a security vulnerability exists in MaianAffiliate v.1.0, which stems from the existence of a PHP code injection issue. An authenticated attacker can exploit this vulnerability to obtain RCE through the MaianAffiliat...
CVE-2022-1772
The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing th...
CVE-2022-1772
The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing th...
Cross site scripting
The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing th...
CVE-2022-1772 Google Places Review < 2.0.0 - Admin+ Stored Cross Site Scripting
The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing th...
CVE-2022-30371
Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/cargotypes/viewcargotype.php?id=...
Home Owners Collection Management Cross-Site Scripting Vulnerability (CNVD-2022-77871)
Fairway Independent Mortgage Home Owners Collection Management is a home purchase loan system from Fairway Independent Mortgage. home owners collection management v1 version contains a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and...
Dairy Farm Shop Management System SQL Injection Vulnerability (CNVD-2022-68886)
Dairy Farm Shop Management System is a dairy farm store management system.A SQL injection vulnerability exists in Dairy Farm Shop Management System version 1.0, which stems from multiple SQL injection vulnerabilities in the username and password parameters in the administration panel. An attacker...
Home Owners Collection Management 跨站脚本漏洞
Fairway Independent Mortgage Home Owners Collection Management is a home purchase loan system from Fairway Independent Mortgage. home owners collection management v1 version contains a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and...
Directory Management System SQL注入漏洞
Directory Management System is a directory management system. SQL injection vulnerability exists in Directory Management System version 1.0, which stems from multiple SQL injection vulnerabilities in the username and password parameters in the administration panel. An attacker could use this...
Ecommerce-Website File Upload Vulnerability
Ecommerce-Website is a complete e-commerce website with an administration panel built using PHP and MySql. v1.1.0 of Ecommerce-Website is vulnerable to a file upload vulnerability, which stems from a lack of file upload restrictions in public/admin/index.php?addproduct The vulnerability is caused...
Sylius Cross-Site Scripting Vulnerability (CNVD-2022-20526)
Sylius is an open source e-commerce platform. Sylius suffers from a cross-site scripting vulnerability that could be exploited by attackers to upload SVG files containing XSS code in the administration panel to obtain user cookies and construct phishing attacks...
Home Owners Collection Management System信任管理问题漏洞
Home Owners Collection Management System, a homeowner collection management system, is vulnerable to a trust management issue stemming from Home Owners Collection Management System v1.0. System v1.0 was found to contain hard-coded credentials, which could be exploited by an attacker to escalate...
Home Owners Collection Management System 信任管理问题漏洞
Home Owners Collection Management System, a homeowner collection management system, is vulnerable to a trust management issue stemming from Home Owners Collection Management System v1.0. System v1.0 was found to contain hard-coded credentials, which could be exploited by an attacker to escalate...
Plesk Cross-Site Request Forgery Vulnerability (CNVD-2022-91163)
Plesk is a hosting control panel from the Swiss company Plesk. version 18.0.37 of Plesk is vulnerable to cross-site request forgery, which stems from the software's lack of validation of cross-site request forgery tokens. An attacker could exploit this vulnerability to insert data in the user and...
