30 matches found
CVE-2026-88396
ApiAdmin versions v5.0 and before are vulnerable to Directory Traversal via the POST /admin/Index/upload endpoint. The application fails to perform whitelist, blacklist, or content checks on uploaded file extensions, allowing the move_uploaded_file() function to drop files into the web-accessible...
EUVD-2026-92468
ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim there is no whitelist, blacklist or content check and moveuploadedfile drops the file into the web-accessible directory...
EUVD-2026-92467
ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter...
CVE-2026-88397
ApiAdmin versions v.5.0 and before are vulnerable to SQL Injection within the user-list endpoint at GET /admin/User/getUsers . The vulnerability is triggered specifically via the gid parameter . No remediation details, specific exploit links, or MITRE ATT&CK IDs are provided in the documents.
CVE-2026-71622
SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php component...
CVE-2026-71620
File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file...
CVE-2026-71620
File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file...
CVE-2026-71622
SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php component...
CVE-2026-71620
A File Upload vulnerability exists in Zhao-github ApiAdmin v.5.0.1 , allowing a remote attacker to execute arbitrary code . The root cause is the ability to upload a crafted .php file to the system. The provided documents do not specify a remediation or a direct link to a functional exploit.
CVE-2026-71622: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php component...
PT-2026-86243
SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php component...
EUVD-2026-71746
SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php component...
CVE-2026-71620
File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file...
EUVD-2026-71711
File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file...
CVE-2026-71620: Unrestricted Upload of File with Dangerous Type
File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file...
CVE-2026-71622
SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php component...
CVE-2026-71622
A SQL injection vulnerability exists in Zhao-github APiAdmin v.5.0.1 . This flaw allows a remote attacker to obtain sensitive information by exploiting the User.php component. No specific remediation or exploit details are provided in the documents.
PT-2026-86237
Name of the Vulnerable Software and Affected Versions ApiAdmin version 5.0.1 Description A file upload flaw allows a remote attacker to execute arbitrary code by uploading a specially crafted .php file. Recommendations At the moment, there is no information about a newer version that contains a f...
