CVE-2024-32344

CMSimple v5.15 is affected by an XSS in the Settings menu, via crafted input in the Language section Edit parameter. The vulnerability arises from insufficient filtering/escaping of user-supplied data in that parameter, enabling arbitrary script/HTML execution. In-the-wild details are not provide...

CVE-2024-30983

SQL Injection in phpgurukul Cyber Cafe Management System Using PHP & MySQL 1.0 allows arbitrary SQL via the compname parameter in /edit-computer-detail.php. Multiple sources (NVD, Red Hat, CVE lists, CNNVD, PT Security) confirm the vulnerable component and parameter. Impact details in sources ind...

Cyber Cafe Management System 安全漏洞

Cyber Cafe Management System CCMS is a cyber cafe management system by the individual developer Anuj Kumar. A security vulnerability exists in Cyber Cafe Management System version 1.0, which stems from a cross-site scripting XSS vulnerability in the compname parameter in the file...

CVE-2024-24486

An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to edit device settings via the SAVE EEPDATA command...

CVE-2023-47626

CVE-2023-47626 affects iTop (an IT service management platform). The vulnerability is an XSS risk that occurs when displaying/editing a user’s personal tokens; the root cause is improper handling of token-related input in the UI, enabling script execution. A fix is available in iTop v3.1.1 (and l...

WordPress Smart Forms plugin < 2.6.94 - Edit Entries via CSRF vulnerability

Edit Entries via CSRF vulnerability discovered by Amir Hossein Fallahi in WordPress Plugin Smart Forms versions 2.6.94...

CVE-2024-3771

A vulnerability was found in PHPGurukul Student Record System 3.20 and classified as critical. Affected by this issue is some unknown functionality of the file /edit-subject.php. The manipulation of the argument sub1/sub2/sub3/sub4/udate leads to sql injection. The attack may be launched remotely...

CVE-2024-3771 PHPGurukul Student Record System edit-subject.php sql injection

A vulnerability was found in PHPGurukul Student Record System 3.20 and classified as critical. Affected by this issue is some unknown functionality of the file /edit-subject.php. The manipulation of the argument sub1/sub2/sub3/sub4/udate leads to sql injection. The attack may be launched remotely...

CVE-2024-3767

A vulnerability classified as critical was found in PHPGurukul News Portal 4.1. This vulnerability affects unknown code of the file /admin/edit-post.php. The manipulation of the argument posttitle/category leads to sql injection. The attack can be initiated remotely. The exploit has been disclose...

CVE-2024-3767 PHPGurukul News Portal edit-post.php sql injection

A vulnerability classified as critical was found in PHPGurukul News Portal 4.1. This vulnerability affects unknown code of the file /admin/edit-post.php. The manipulation of the argument posttitle/category leads to sql injection. The attack can be initiated remotely. The exploit has been disclose...

CVE-2024-3767 PHPGurukul News Portal edit-post.php sql injection

A vulnerability classified as critical was found in PHPGurukul News Portal 4.1. This vulnerability affects unknown code of the file /admin/edit-post.php. The manipulation of the argument posttitle/category leads to sql injection. The attack can be initiated remotely. The exploit has been disclose...

PHPGurukul News Portal SQL注入漏洞

PHPGurukul News Portal is a news portal from PHPGurukul Inc. An injection vulnerability exists in PHPGurukul News Portal version 4.1, which stems from the parameter posttitle in the file /admin/edit-post.php that can lead to SQL injection...

Silex Technology DS-600 安全漏洞

The Silex Technology DS-600 is a hardware device from Silex Technology, Inc. designed to easily connect and share USB 3.0 and 2.0 devices over a network. A security vulnerability exists in the Silex Technology DS-600 version v.1.4.1. A remote attacker could exploit the vulnerability to edit devic...

PT-2024-24340 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.10.7 Argo CD versions prior to 2.9.12 Argo CD versions prior to 2.8.16 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces...

PHPGurukul Student Record System SQL注入漏洞

Student Record System is a software application. Student Record System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameters sub1/sub2/sub3/sub4/udate in the file /edit-subject.php. An attacker can exploit thi...

PT-2024-27721 · Unknown · Phpgurukul Student Record System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Student Record System version 3.20 Description: A critical issue was found in the PHPGurukul Student Record System, affecting some unknown functionality of the file /edit-subject.php. The manipulation of the arguments sub1, sub2,...

PT-2024-23076

Name of the Vulnerable Software and Affected Versions Evolution Controller versions 2.04.560.31.03.2024 and below Description The Web interface of Evolution Controller contains poorly configured access control on the DESKTOP EDIT USER GET CARD endpoint, allowing an unauthenticated attacker to...

Concrete CMS 9.2.7 Cross Site Scripting / Open Redirect Vulnerabilities

Concrete CMS version 9.2.7 suffers from information disclosure, open redirection, and persistent cross site scripting vulnerabilities. Exploit Title: Multiple Web Flaws in concretecmsv9.2.7 Exploit Author: Andrey Stoykov Version: 9.2.7 Tested on: Ubuntu 22.04 Blog: http://msecureltd.blogspot.com...

CVE-2024-31997 XWiki Platform remote code execution from account through UIExtension parameters

XWiki Platform is a generic wiki platform. Prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, parameters of UI extensions are always interpreted as Velocity code and executed with programming rights. Any user with edit right on any document like the user's own profile can create UI extensions. Th...

CVE-2024-31983 XWiki Platform: Remote code execution from edit in multilingual wikis via translations

XWiki Platform is a generic wiki platform. In multilingual wikis, translations can be edited by any user who has edit right, circumventing the rights that are normally required for authoring translations script right for user-scope translations, wiki admin for translations on the wiki. Starting i...