PT-2023-25444 · Phpjabbers · Phpjabbers Class Scheduling System

Name of the Vulnerable Software and Affected Versions: PHP Jabbers Class Scheduling System version 1.0 Description: The issue concerns a lack of verification when changing an email address and/or password on the Profile Page, allowing remote attackers to take over accounts. Recommendations: For P...

Class Scheduling System Data Forgery Problem Vulnerability

Class Scheduling System is a class scheduling system by jkev Personal Developer. A security vulnerability exists in Class Scheduling System version 1.0, which stems from a lack of authentication when changing email addresses or passwords, allowing a remote attacker to take over an account...

CVE-2023-36137: Improper Neutralization of Input During Web Page Generation

There is a Cross Site Scripting XSS vulnerability in the "theme" parameter of preview.php in PHPJabbers Class Scheduling System 1.0...

CVE-2023-36134: Insufficient Verification of Data Authenticity

In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts...

PT-2023-25447 · Phpjabbers · Phpjabbers Class Scheduling System

Name of the Vulnerable Software and Affected Versions: PHPJabbers Class Scheduling System version 1.0 Description: The issue is related to a Cross Site Scripting XSS vulnerability. This vulnerability is found in the theme parameter of the "preview.php" file. Recommendations: For PHPJabbers Class...

Class Scheduling System Cross-Site Scripting Vulnerability

Class Scheduling System is a class scheduling system by jkev Personal Developer. A security vulnerability exists in Class Scheduling System version 1.0 due to a cross-site scripting XSS vulnerability in the theme parameter of preview.php...

CVE-2023-36134

In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts...

CVE-2023-36135

User enumeration is found in in PHPJabbers Class Scheduling System v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

CVE-2023-36137

There is a Cross Site Scripting XSS vulnerability in the "theme" parameter of preview.php in PHPJabbers Class Scheduling System 1.0...

CVE-2023-36137

There is a Cross Site Scripting XSS vulnerability in the "theme" parameter of preview.php in PHPJabbers Class Scheduling System 1.0...

CVE-2023-36134

CVE-2023-36134 affects PHP Jabbers Class Scheduling System 1.0. The issue is a lack of verification when changing an email address and/or password on the Profile Page, enabling remote attackers to take over accounts. No exploit vectors or affected versions beyond 1.0 are specified in the provided...

CVE-2023-36135

The CVE-2023-36135 issue affects PHPJabbers Class Scheduling System v1.0. During password recovery, a difference in responses between valid and invalid usernames enables user enumeration, which can facilitate brute-forcing existing accounts. The NVD entry and related sources confirm the affected ...

CVE-2023-36135: Undefined Security Weakness

User enumeration is found in in PHPJabbers Class Scheduling System v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

CVE-2023-36137

CVE-2023-36137 affects PHPJabbers Class Scheduling System v1.0. The vulnerability is a Cross Site Scripting (XSS) in the theme parameter of preview.php. Root cause: untrusted input in the theme parameter can be reflected in the page, enabling script execution. According to the CVSS data, the impa...

PT-2023-25445 · Phpjabbers · Phpjabbers Class Scheduling System

Name of the Vulnerable Software and Affected Versions: PHPJabbers Class Scheduling System version 1.0 Description: The issue is related to user enumeration, which occurs during the password recovery process. A difference in messages could allow an attacker to determine if a user is valid or not,...

Information disclosure

An issue in the delete function in the MenuController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete menus created by the Administrator...

CVE-2023-39109

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery SSRF via the patha parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs...

PT-2023-26784 · Rconfig · Rconfig

Name of the Vulnerable Software and Affected Versions: rconfig version 3.9.4 Description: The issue allows authenticated attackers to make arbitrary requests via injection of crafted URLs, exploiting a Server-Side Request Forgery SSRF vulnerability. This is achieved through the path b parameter i...

CVE-2023-38990

CVE-2023-38990 affects Jeesite v1.2.6, where an issue in the MenuController.delete function allows an authenticated attacker to arbitrarily delete menus created by the Administrator. The vulnerability stems from improper authorization/validation in the delete path, leading to unauthorized state c...

Information disclosure

An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role information...