Logic Flaw Vulnerability in OurPHP Backend Administration Interface

OurPHP is an enterprise website builder that incorporates e-commerce features. A logic flaw vulnerability exists in OurPHP's backend management interface, which can be exploited by attackers to modify high-privileged administrator passwords...

U.S. Dept Of Defense: Blind Stored XSS Payload fired at the backend on https://█████████/

Summary: I have just gotten an email notification from my XSSHunter payload that my blind stored XSS has been triggered by an administrator on the █████████ site, in the following URL: javascript https://█████/████ Admin IP address: ████████ User-Agent: █████████ Cookies: javascript ██████...

OPENSUSE-SU-2020:2168-1 Security update for rclone

This update for rclone fixes the following issues: rclone was updated to version 1.53.3: Bug Fixes - Fix incorrect use of math/rand instead of crypto/rand CVE-2020-28924 boo1179005 Nick Craig-Wood - Check https://github.com/rclone/passwordcheck for a tool check for weak passwords generated by...

SQL Injection Vulnerability in the Backend of Miku CMS Movie and TV System

Miku CMS Movie & TV System is a movie & TV management system designed for different needs of webmasters. A SQL injection vulnerability exists in the backend of Miku CMS, which can be exploited by attackers to obtain sensitive information from the database...

File upload vulnerability in AikCms backend vi***_ad***.php page

AikCms is a lightweight CMS. A file upload vulnerability exists in the AikCms backend viad.php page, which can be exploited by an attacker to upload a webshell and gain server privileges...

File upload vulnerability in DedeCMSV6 backend fi***_na***_co***.php file

DedeCMSV6 is based on PHP 7.x development, is scalable and fully open source. A file upload vulnerability exists in the DedeCMSV6 backend finaco.php file. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...

Command execution vulnerability in vaeThink backend Au***.php file

vaeThink is a PHP content management framework built on Layui and tp5. A command execution vulnerability exists in the vaeThink backend Au.php file. An attacker can exploit this vulnerability to gain server privileges...

UNEDITABLE_SCHEMAS and UNEDITABLE_TABLE_DESCRIPTION_MATCH_RULES not respected by frontend service backend

Impact Any install that has UNEDITABLESCHEMAS and/or UNEDITABLETABLEDESCRIPTIONMATCHRULES set in the front-end, is being impacted. The value of these properties is ignored if set, allowing any user to modify table and column descriptions, even though the properties imply they shouldn't be. Patche...

GHSA-47QG-Q58V-7VRP UNEDITABLE_SCHEMAS and UNEDITABLE_TABLE_DESCRIPTION_MATCH_RULES not respected by frontend service backend

Impact Any install that has UNEDITABLESCHEMAS and/or UNEDITABLETABLEDESCRIPTIONMATCHRULES set in the front-end, is being impacted. The value of these properties is ignored if set, allowing any user to modify table and column descriptions, even though the properties imply they shouldn't be. Patche...

ThinkAdmin 跨站脚本漏洞

ThinkAdmin is a backend administration framework developed based on the latest ThinkPHP V6 , using the MIT protocol open source. thinkAdmin v1, v6 exists a stored cross-site scripting vulnerability. A remote attacker can use the vulnerability to inject arbitrary Web script or HTML...

Damn-Vulnerable-Bank - Vulnerable Banking Application For Android

Damn Vulnerable Bank Android Application aims to provide an interface for everyone to get a detailed understanding with internals and security aspects of android application. How to Use Application Clone the repository and run the Backend Server as per instructions in the link. We have released t...

SQL Injection Vulnerability in MetInfo Backend of Changsha Mito Information Technology Co.

MetInfo is an open source free CMS building system suitable for enterprise building. Changsha Mito Information Technology Co., Ltd. MetInfo backend has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

OPENSUSE-SU-2020:2035-1 Security update for rclone

This update for rclone fixes the following issues: rclone was updated to version 1.53.3: Bug Fixes - Fix incorrect use of math/rand instead of crypto/rand CVE-2020-28924 boo1179005 Nick Craig-Wood - Check https://github.com/rclone/passwordcheck for a tool check for weak passwords generated by...

Command Execution Vulnerability in Zendo Backend

Zendo is a homegrown open source project management software. A command execution vulnerability exists in the Zendo backend. An attacker can exploit this vulnerability to gain server privileges...

Weak Password Vulnerability in WIFI Industrial Router F5936 at Xiamen Sihsin Communication Technology Co.

WIFI Industrial Router F5936 is industrial grade WIFI router. Weak password vulnerability exists in WIFI Industrial Router F5936 of Xiamen Sihsin Communication Technology Co. An attacker can use the vulnerability to log into the server backend and obtain sensitive information...

Command execution vulnerability in MLECMS backend te***_la***.php file

MLECMS is a professional website building system based on PHP+MYSQL as the core development. A command execution vulnerability exists in the MLECMS backend tela.php file. An attacker can exploit this vulnerability to gain server privileges...

SQL Injection Vulnerability in the Backend of Arsenal CMS (CNVD-2020-70791)

Jingxun CMS is a website construction and management system independently developed by Taizhou Jingxun Information Technology Co. A SQL injection vulnerability exists in the back-end of the CMS. An attacker can exploit the vulnerability to obtain sensitive information from the database...

Sandbox Escape

October is vulnerable to arbitrary code execution. An authenticated backend user with cms.managepages, cms.managelayouts, or cms.managepartials permissions is allowed to write malicious Twig code leading to an escape from sandbox even if cms.enableSafeMode is set. This vulnerability is a bypass o...

Arbitrary Code Execution

October is vulnerable to arbitrary code execution. An authenticated backend user with cms.managepages, cms.managelayouts, or cms.managepartials permissions is allowed to write malicious Twig code leading to an escape from sandbox even if cms.enableSafeMode is set...

SQL Injection Vulnerability in the Backend Management System of Wastoduo

Nanjing Jiuzhe Software Technology Co., Ltd. business scope includes: software development, technical services, technical consulting services, technology transfer and so on. There is a SQL injection vulnerability in the backend management system of Waste DuoDuo. Attackers can utilize the...