Online Pet Shop We App 代码问题漏洞

Online Pet Shop We App is an online pet store web application by Carlo Montero Personal Developer. A security vulnerability exists in Online Pet Shop We App v1.0, which originates from an arbitrary file upload vulnerability via the Edit function in the Product Listing module, which allows an...

Html Injection Stored in edit customers

Description HTML Injection is a vulnerability in which the attacker can inject malicious html content in the webpage. Proof of Concept 1. Open tab Edit Customers, click Edit customer 2. Inject this payload at field Name: TEST TEST TEST. And then click Save 3. Go to the profile page of this...

GitLab: Attacker is able to create,Edit & delete notes and leak the title of a victim's private personal snippet

An attacker was able to create, edit, and delete notes on a victim's private personal snippet, leaking the title of the snippet on the attacker's activity page. The attack was achieved by changing the POST parameter noteabletype from "issue" to "personalsnippet" and posting a comment within a...

Command injection

myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the vsftplicense parameter when sending HTTP POST requests to the /edit/server endpoint...

Vesta Control Panel 参数注入漏洞

Vesta Control Panel VestaCP is an open source web hosting control panel. A parameter injection vulnerability exists in Vesta Control Panel versions prior to 0.9.8-26-43 and Vesta Control Panel versions prior to 0.9.8-26, which stems from the fact that when it sends an HTTP POST request to the...

PT-2022-12942 · Unknown · Vesta Control Panel

Name of the Vulnerable Software and Affected Versions: myVesta Control Panel versions prior to 0.9.8-26-43 Vesta Control Panel versions prior to 0.9.8-26 Description: The issue allows an authenticated and remote administrative user to execute arbitrary commands. This can be achieved by sending HT...

CVE-2022-36966

Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference IDOR vulnerability in SolarWinds Platform 2022.3 and previous...

SolarWinds Platform 安全漏洞

SolarWinds Platform is a unified monitoring, observability, and service management platform from U.S.-based SolarWinds, Inc. A security vulnerability exists in SolarWinds Platform version 2022.3 and prior versions that stems from an insecure direct object reference IDOR. An attacker with node...

Cross site scripting

OroCommerce is an open-source Business to Business Commerce application. Versions between 4.1.0 and 4.1.17 inclusive, 4.2.0 and 4.2.11 inclusive, and between 5.0.0 and 5.0.3 inclusive, are vulnerable to Cross-site Scripting in the UPS Surcharge field of the Shipping rule edit page. The attacker...

Billing System Project 代码问题漏洞

Billing System Project is a billing system project by Mayuri K. Individual developer. A security vulnerability exists in Billing System Project v1.0, which stems from an arbitrary file upload vulnerability found in component /phpaction/editProductImage. An attacker can exploit this vulnerability ...

Liferay Portal 跨站脚本漏洞

Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses technologies such as EJB as well as JMS and can be used as a web publishing and sharing workspace, enterprise collaboration platform, social network, etc. A security vulnerability exists in Liferay Portal versions...

PT-2022-20477 · Unknown · Orocommerce

Name of the Vulnerable Software and Affected Versions: OroCommerce versions 4.1.0 through 4.1.17 OroCommerce versions 4.2.0 through 4.2.11 OroCommerce versions 5.0.0 through 5.0.3 Description: The issue concerns Cross-site Scripting in the UPS Surcharge field of the Shipping rule edit page. An...

GetSimple CMS 安全漏洞

GetSimple CMS is a content management system CMS written in PHP. A security vulnerability exists in GetSimple CMS version v3.3.16, which was discovered to contain a remote code execution RCE vulnerability via the editedfile parameter in admin/theme-edit.php...

Liferay Portal 跨站脚本漏洞

Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network and more. A security vulnerability exists in Liferay Portal...

CVE-2022-41431

xzs v3.8.0 was discovered to contain a cross-site scripting XSS vulnerability in the component /admin/question/edit. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title text field...

xzs 跨站脚本漏洞

Civic Jump Technology xzs Learning Zest Open Source Exam System is the Learning Zest Open Source Exam System from Civic Jump Technology. A security vulnerability exists in xzs version v3.8.0, which originated from a cross-site scripting XSS vulnerability found in the component /admin/question/edi...

CVE-2022-41431

xzs v3.8.0 was discovered to contain a cross-site scripting XSS vulnerability in the component /admin/question/edit. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title text field...

The vulnerability of the admin_edit.php implementation in the online book store allows a hacker to execute arbitrary code.

The vulnerability of the adminedit.php script used by the Online Book Store involves a lack of protection for the SQL query structure when processing the bookisbn parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

Online Diagnostic Lab Management System 代码问题漏洞

Online Diagnostic Lab Management System is an online diagnostic lab management system. A security vulnerability exists in Online Diagnostic Lab Management System version v1.0, which originates from an arbitrary file upload vulnerability contained through the component...

PT-2022-22301 · Sourcecodester · Sourcecodester Human Resource Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Human Resource Management System affected versions not specified Description: A critical issue affects the SourceCodester Human Resource Management System, specifically some unknown functionality of the file city.php. The...