EUVD-2023-46008

Malicious code in bioql PyPI...

EUVD-2023-43874

Malicious code in bioql PyPI...

EUVD-2025-15709

Malicious code in bioql PyPI...

EUVD-2023-12479

Malicious code in bioql PyPI...

EUVD-2023-39107

Malicious code in bioql PyPI...

EUVD-2021-30935

Malicious code in bioql PyPI...

EUVD-2022-35468

Malicious code in bioql PyPI...

EUVD-2023-50169

Malicious code in bioql PyPI...

EUVD-2022-52616

Malicious code in bioql PyPI...

EUVD-2024-17320

Malicious code in bioql PyPI...

EUVD-2025-26233

Malicious code in bioql PyPI...

EUVD-2024-22120

Malicious code in bioql PyPI...

CVE-2025-10615

A vulnerability was identified in itsourcecode E-Commerce Website 1.0. This impacts an unknown function of the file /admin/products.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly available and might be used...

Passwordstate Auth Bypass

The vulnerability of Passwordstate relates to the possibility of bypassing the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the administration panel by navigating to a specially crafted URL address...

CVE-2025-51990

XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting XSS vulnerabilities in the Administration interface, specifically under the Presentation section of the Global Preferences panel. An authenticated administrator can inject arbitrary JavaScript payloads into the HTTP...

Cross-site Scripting (XSS)

Overview moonshine/moonshine is a Laravel administration panel Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Name parameter when creating a new Admin, due to improper sanitization of user input. Details Cross-site scripting or XSS is a code vulnerability tha...

CVE-2024-27609

Bonita before 2023.2-u2 allows stored XSS via a UI screen in the administration panel...

CVE-2024-24721

An issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack through which an attacker may be able to access the administration panel...

CVE-2024-23733

The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before CoreFix7 allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary username and a blank password to the...

CVE-2024-22733

TP Link MR200 V4 Firmware version 210201 was discovered to contain a null-pointer-dereference in the web administration panel on /cgi/login via the sign, Action or LoginStatus query parameters which could lead to a denial of service by a local or remote unauthenticated attacker...