PT-2023-32826 · Unknown · Sourcecodester Online Student Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Student Management System version 1.0 Description: A vulnerability has been found in the SourceCodester Online Student Management System, classified as problematic. The issue affects an unknown functionality of the file...

SourceCodester Student Management System Cross-Site Scripting Vulnerability

SourceCodester Student Management System is a set of online student management system from SourceCodester, Inc. in the United States. The system provides student information management, announcement management, course management and other functions. A cross-site scripting vulnerability exists in...

WordPress WP Edit Username Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)

Software WP Edit Username Type Plugin Vulnerable versions = 1.0.5 Fixed in 1.0.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47527 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 3874545cb784 Credits Jeongwoo-LeeRoronoa Required privileg...

CVE-2023-49371

RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit...

CVE-2023-49371

RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit...

Sql injection

RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit...

PT-2023-31185 · Ruoyi · Ruoyi

Name of the Vulnerable Software and Affected Versions: RuoYi versions up to v4.6 Description: The issue is a SQL injection vulnerability. It can be exploited via the "/system/dept/edit" API endpoint. Recommendations: For versions up to v4.6, as a temporary workaround, consider restricting access ...

CVE-2023-49371

RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit...

CVE-2023-49371

RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit...

RuoYi Security Breach

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v4.6 and earlier versions, which originates from a SQL injection vulnerability in /system/dept/edit...

CVE-2023-49371

CVE-2023-49371 affects Ruoyi (up to v4.6) with a SQL injection in the /system/dept/edit endpoint. The vulnerability is high severity (CVSS 3.1: 9.8, NETWORK, no user interaction). Returns no explicit patch in the provided documents; a PTSecurity advisory notes the issue and suggests restricting a...

CVE-2023-6410

A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via editprofile.php in multiple parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retriev...

CVE-2023-48912

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/archives/edit...

CVE-2023-48912

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/archives/edit...

CVE-2023-48912

Dreamer CMS v4.1.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the /admin/archives/edit component. The CVE entry ties the issue to Dreamer CMS and specifies CSRF as the flaw, but the provided documents do not include a confirmed remediation (patch/version) or exploitation detail...

CVE-2023-48912

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/archives/edit...

Dreamer CMS Cross-Site Request Forgery Vulnerability

Dreamer CMS is a Dreamer Content Management System by Junnan Wang, an individual developer in China. A cross-site request forgery vulnerability exists in Dreamer CMS version v4.1.3, which stems from a cross-site request forgery CSRF vulnerability contained in the component /admin/archives/edit...

League Table < 1.14 - Tables Cloning/Update/Deletion via CSRF

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation in the view/tables.php file. This makes it possible for unauthenticated attackers to clone, edit, update, and delete tables via a forged request granted they can trick a site...

Alumne LMS Cross-Site Scripting Vulnerability

Alumne LMS is an e-learning platform from Alumne LMS, Inc. A cross-site scripting vulnerability exists in Alumne LMS version 4.0.0.1.08, which stems from a lack of proper cleanup in the localidad field on the /users/editmy page, and can be exploited by an attacker to inject a custom JavaScript lo...

Astra Bulk Edit < 1.2.8 - Missing Authorization

Description The Astra Bulk Edit plugin for WordPress is vulnerable to unauthorized missing authorization due to a missing capability check on the savepostbulkedit function in versions up to, and including, 1.2.7. This makes it possible for attackers with contributor-level access or higher to bulk...