CVE-2023-1165 Zhong Bang CRMEB Java list sql injection

A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It has been classified as critical. This affects an unknown part of the file /api/admin/system/store/order/list. The manipulation of the argument keywords leads to sql injection. The exploit has been disclosed to the public and may be used...

CVE-2023-1165: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It has been classified as critical. This affects an unknown part of the file /api/admin/system/store/order/list. The manipulation of the argument keywords leads to sql injection. The exploit has been disclosed to the public and may be used...

CVE-2022-4597: Improper Neutralization

A vulnerability, which was classified as problematic, was found in Shoplazza LifeStyle 1.1. Affected is an unknown function of the file /admin/api/admin/v2products of the component Create Product Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely...

CVE-2022-32994: Unrestricted Upload of File with Dangerous Type

Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload...

API Admin Auth Weakness in tomato

Versions of tomato prior to 0.0.6 are affected by a somewhat complex authentication bypass vulnerability in the admin service when only a single access key is configured on the server. The vulnerability allows an attacker to guess the password for the admin service, no matter how complex that...

CVE-2019-14521: Improper Limitation of a Pathname to a Restricted Directory

The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location on the server via path traversal in the filename parameter...

CVE-2018-7063: Improper Restriction of XML External Entity Reference

In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may still be able to perform read/write operations on parts of the XML API. This can lead to unauthorized access to the API and complete...

Cross site request forgery (csrf)

JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...

CVE-2018-19544

JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news...

CVE-2018-19545: Cross-Site Request Forgery (CSRF)

JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...

CVE-2018-19544: Cross-Site Request Forgery (CSRF)

JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news...

SQL Injection Vulnerability in MIPCMS ApiAdminTag.php Page

MIPCMS is a free and open source based on Baidu Mobile Accelerator MIP engine based on the development of articles, information, content management system, but also the system for the Internet webmasters, entrepreneurs and other groups to create SEO-optimized after the station-building system. A...