EUVD-2025-199690

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension framework permits untrusted extension code to execute arbitrary system commands on the server when a lifecycle hook is invoked, resulting in remote cod...

CVE-2025-65276

CVE-2025-65276 affects the HashTech project. A missing authentication check on /admin_index.php allows unauthenticated access to the admin dashboard, enabling full administrative control (viewing/modifying user accounts, managing orders, changing payments, editing product listings) and potential ...

openstack mistral-dashboard 安全漏洞

OpenStack Mistral-Dashboard is an OpenStack open source GUI plugin. A security vulnerability exists in openstack mistral-dashboard, which stems from a local file inclusion vulnerability in the Create Workbook feature that could lead to the disclosure of the contents of arbitrary local files...

PT-2025-48173

Name of the Vulnerable Software and Affected Versions mistral-dashboard plugin for openstack affected versions not specified Description The mistral-dashboard plugin for openstack contains a local file inclusion issue within the 'Create Workbook' feature. This could lead to the disclosure of...

CVE-2025-65276

An unauthenticated administrative access vulnerability exists in the open-source HashTech project https://github.com/henzljw/hashtech 1.0 thru commit 5919decaff2681dc250e934814fc3a35f6093ee5 2021-07-02. Due to missing authentication checks on /adminindex.php, an attacker can directly access the...

PT-2025-48184

Name of the Vulnerable Software and Affected Versions HashTech versions 1.0 through commit 5919decaff2681dc250e934814fc3a35f6093ee5 Description A missing authentication check on the /admin index.php endpoint allows an attacker to access the administrative dashboard without valid credentials. This...

PT-2025-48161

Name of the Vulnerable Software and Affected Versions Frappe CRM version 1.53.1 Description The Frappe CRM Dashboard Controller contains multiple SQL injection flaws. These flaws are due to the unsafe concatenation of user-controlled parameters into dynamic SQL statements. The issue allows for...

hashtech 安全漏洞

hashtech is an online shopping platform by henz individual developers. A security vulnerability exists in HashTech that stems from a lack of authentication checks in /adminindex.php, which could allow an unauthenticated attacker to gain direct access to the admin dashboard...

CVE-2025-65276

An unauthenticated administrative access vulnerability exists in the open-source HashTech project https://github.com/henzljw/hashtech 1.0 thru commit 5919decaff2681dc250e934814fc3a35f6093ee5 2021-07-02. Due to missing authentication checks on /adminindex.php, an attacker can directly access the...

GHSA-675Q-66GF-GQG8 OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation

Summary During the login process, the server response included a parameter called isMasterAdmin. By intercepting and modifying this parameter value from false to true, a user is able to gain access to the admin dashboard interface. However, despite accessing the admin panel, the user does not hav...

OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation

Summary During the login process, the server response included a parameter called isMasterAdmin. By intercepting and modifying this parameter value from false to true, a user is able to gain access to the admin dashboard interface. However, despite accessing the admin panel, the user does not hav...

EUVD-2025-199602

A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated low-privilege user can craft a malicious dashboard containing a JavaScript payload and share it with victim users, or a victim can be...

CVE-2025-40890

A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated low-privilege user can craft a malicious dashboard containing a JavaScript payload and share it with victim users, or a victim can be...

CVE-2025-40890 Stored Cross-Site Scripting (XSS) in Dashboards in Guardian/CMC before 25.4.0

A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated low-privilege user can craft a malicious dashboard containing a JavaScript payload and share it with victim users, or a victim can be...

EUVD-2025-199583

The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized data export due to a missing capability check on the cdashwatchforexport function in all versions up to, and including, 3.3.11. This makes it possible for unauthenticated attackers to export business...

CVE-2025-13414 Chamber Dashboard Business Directory <= 3.3.11 - Missing Authorization to Unauthenticated Business Information Export

The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized data export due to a missing capability check on the cdashwatchforexport function in all versions up to, and including, 3.3.11. This makes it possible for unauthenticated attackers to export business...

CVE-2025-13414 Chamber Dashboard Business Directory <= 3.3.11 - Missing Authorization to Unauthenticated Business Information Export

The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized data export due to a missing capability check on the cdashwatchforexport function in all versions up to, and including, 3.3.11. This makes it possible for unauthenticated attackers to export business...

WordPress Chamber Dashboard Business Directory plugin <= 3.3.11 - Missing Authorization to Unauthenticated Business Information Export vulnerability

Missing Authorization to Unauthenticated Business Information Export vulnerability discovered by Legion Hunter in WordPress Plugin Chamber Dashboard Business Directory versions = 3.3.11...

Nozomi Networks CMC和Nozomi Networks Guardian 跨站脚本漏洞

Nozomi Networks CMC and Nozomi Networks Guardian are both products of Nozomi Networks, Inc. of the U.S. Nozomi Networks CMC is a network management platform.Nozomi Networks Guardian is a protection software. A cross-site scripting vulnerability exists in Nozomi Networks CMC and Nozomi Networks...

PT-2025-48014

The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized data export due to a missing capability check on the cdash watch for export function in all versions up to, and including, 3.3.11. This makes it possible for unauthenticated attackers to export business...