CVE-2023-7172: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the component Admin Dashboard. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been...

PHPGurukul Hospital Management System SQL Injection Vulnerability

PHPGurukul Hospital Management System is a PHP and MySQL based hospital management system. A SQL injection vulnerability exists in PHPGurukul Hospital Management System version 1.0, which stems from the component Admin Dashboard that causes SQL injection...

CVE-2023-23634

SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/dashboard/activity endpoint...

Documize Security Breach

Documize is an open source document collaboration system built on Golang and EmberJS. A security vulnerability exists in Documize version 5.4.2, which stems from an SQL injection vulnerability. The vulnerability allows remote attackers to execute arbitrary code via user parameters in the...

CVE-2023-23634: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/dashboard/activity endpoint...

CVE-2023-23634

SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/dashboard/activity endpoint...

PT-2023-19094 · Documize · Documize

Name of the Vulnerable Software and Affected Versions: Documize version 5.4.2 Description: The issue allows remote attackers to execute arbitrary code via the user parameter of the "/api/dashboard/activity" endpoint. This enables attackers to potentially gain unauthorized access and control over...

WordPress Crowdsignal Dashboard – Polls, Surveys & more Plugin <= 3.0.11 is vulnerable to Cross Site Scripting (XSS)

Software Crowdsignal Dashboard – Polls, Surveys & more Type Plugin Vulnerable versions = 3.0.11 Fixed in 3.1.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-51488 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1b5223c0a48a Credits...

Ultimate Dashboard < 3.7.12 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-49337

Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. 8.5 and earlier are unaffected...

PT-2023-31171 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions 8.6 through 9.2.2 Description: The issue allows Stored XSS on the Admin Dashboard via the "/dashboard/system/basics/name" API endpoint. The name variable is vulnerable to this type of attack. There is no information...

CVE-2023-49337

Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. 8.5 and earlier are unaffected...

CVE-2023-49337: Improper Neutralization of Input During Web Page Generation

Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. 8.5 and earlier are unaffected...

CVE-2023-49337

Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. 8.5 and earlier are unaffected...

CVE-2023-49337

Concrete CMS before 9.2.3 is vulnerable to Stored XSS on the Admin Dashboard via /dashboard/system/basics/name due to input handling in that endpoint. The issue affects Concrete CMS versions prior to 9.2.3; 8.5 and earlier are unaffected. Multiple sources (including Red Hat, NVD/CVE records, and ...

CVE-2023-49337

Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. 8.5 and earlier are unaffected...

Exploit for Authorization Bypass Through User-Controlled Key in Zabbix

CVE-2019-17382 - Zabbix Authentication Bypass A critical vuln...

The vulnerability in the Dapr Dashboard’s web interface relates to the lack of authentication for critical functions, allowing attackers to influence the confidentiality of protected information.

The vulnerability in the Dapr Dashboard’s web interface is related to the lack of authentication for critical functions. Exploiting this vulnerability could allow a malicious actor to influence the confidentiality of the protected information...

CVE-2023-7038

A vulnerability was found in automad up to 1.10.9. It has been rated as problematic. This issue affects some unknown processing of the file /dashboard?controller=UserCollection::createUser of the component User Creation Handler. The manipulation leads to cross-site request forgery. The attack may...

CVE-2023-50828

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Vongries Ultimate Dashboard – Custom WordPress Dashboard allows Stored XSS.This issue affects Ultimate Dashboard – Custom WordPress Dashboard: from n/a through 3.7.11...