SourceCodester Class Scheduling System SQL注入漏洞

Class Scheduling System is a class scheduling system by jkev individual developer. A SQL injection vulnerability exists in SourceCodester Class Scheduling System version 1.0, which is caused by an unknown function in the file /admin/editsubject.php in the component GET Parameter Handler, which...

PT-2023-21078 · WordPress · Groundhogg

Name of the Vulnerable Software and Affected Versions: Groundhogg plugin for WordPress versions up to, and including, 2.7.9.8 Description: The issue is due to missing nonce validation in the ajax edit contact function, making it possible for authenticated attackers to elevate verified user...

PT-2023-21638 · Sourcecodester · Sourcecodester Class Scheduling System

Name of the Vulnerable Software and Affected Versions: SourceCodester Class Scheduling System version 1.0 Description: A critical issue was found in the SourceCodester Class Scheduling System, affecting an unknown functionality of the file /admin/edit subject.php, specifically the GET Parameter...

CVE-2023-31757

DedeCMS up to v5.7.108 is vulnerable to XSS in sysinfo.php via parameters 'editcfgpowerby' and 'editcfgbeian'...

CVE-2023-31703

Cross Site Scripting XSS in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the from parameter...

CVE-2023-31703

Cross Site Scripting XSS in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the from parameter...

PT-2023-23423 · Escan · Escan

Name of the Vulnerable Software and Affected Versions: eScan management console version 14.0.1400.2281 Description: The issue is related to Cross Site Scripting XSS in the edit user form, allowing a remote attacker to inject arbitrary code via the from parameter. This enables the attacker to...

Contact Form Email < 1.3.38 - Unauthenticated Stored Cross-Site Scripting

The plugin does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability. PoC 1. Publish the default form to a page by clicking on "Contact Form to Email" in the sidebar, and the "Publish" button beside the form name. 2. Visit the form on the frontend...

Contact Form Email < 1.3.38 - Unauthenticated Stored Cross-Site Scripting

The plugin does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability. 1. Publish the default form to a page by clicking on "Contact Form to Email" in the sidebar, and the "Publish" button beside the form name. 2. Visit the form on the frontend. Fil...

CVE-2023-30245

SQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the critid parameter of the editcriteria.php file...

PT-2023-23483 · Sourcecodester · Sourcecodester Faculty Evaluation System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Faculty Evaluation System version 1.0 Description: The issue concerns SQL Injection vulnerability via the "/eval/index.php?page=edit faculty&id=" endpoint. This allows for potential exploitation by injecting malicious SQL code...

WooCommerce Brands < 1.6.46 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Add a Brand with an image, and assign it to ...

Judging Management System SQL注入漏洞

Judging Management System is a judging management system. Judging Management System has a SQL injection vulnerability in version v.1.0. The vulnerability is related to the critid parameter of the editcriteria.php file, and is due to the program not performing strict filter validation of user inpu...

PT-2023-22601 · Unknown · Judging Management System

Name of the Vulnerable Software and Affected Versions: Judging Management System version 1.0 Description: A SQL injection issue allows a remote attacker to execute arbitrary code via the crit id parameter of the "edit criteria.php" file. This enables the attacker to potentially access and...

CVE-2023-2689

A vulnerability classified as critical was found in SourceCodester Billing Management System 1.0. This vulnerability affects unknown code of the file editproduct.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated...

PT-2023-19939 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue allows a user with permissions to edit other users and to create personal access tokens to elevate their privileges to system admin. Recommendations: At the moment, there is no...

Authorization

An improper authorization vulnerability exists in Rocket.Chat 6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage method that only checks whether the user is allowed to edit message in the target room...

Hostel < 1.1.5.2 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Go to Manage Rooms and click on "Click here to...

CVE-2020-18132

Cross Site Scripting XSS vulnerability in MIPCMS 3.6.0 allows attackers to execute arbitrary code via the category name field to categoryEdit...

Stored XSS in module name "Edit Link"

Description I noticed that you filtered the input very carefully. But there are still some parts you missed Proof of Concept 1.Login in URL : https://demo.pimcore.fun/admin. 2.Go to "Search Documents" and filter only "Snippet" search and press search. 3.Go to "/en/shared/teasers/Popular Brands"...