11689 matches found
Drupal core - Moderately critical - Information disclosure - SA-CORE-2022-004
The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module which comes with the Standard...
PT-2022-1768 · Drupal +2 · Drupal +2
Name of the Vulnerable Software and Affected Versions: Drupal affected versions not specified Description: The issue is related to the Quick Edit module in the Drupal content management system, which does not properly check entity access in some circumstances. This could result in users with the...
Drupal 7.x < 7.88 / 9.2.x < 9.2.13 / 9.3.x < 9.3.6 Multiple Vulnerabilities (drupal-2022-02-16)
According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.88, 9.2.x prior to 9.2.13, or 9.3.x prior to 9.3.6. It is, therefore, affected by multiple vulnerabilities. - The Quick Edit module does not properly check entity access in some...
CVE-2022-22854
An access control issue in hprms/admin/?page=user/list of Hospital Patient Record Management System v1.0 allows attackers to escalate privileges via accessing and editing the user list...
CVE-2021-4035
A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports...
XWiki LFI Vulnerability (GHSA-2jhm-qp48-hv5j)
XWiki is prone to a local file inclusion LFI vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...
CVE-2021-44970
MiniCMS v1.11 was discovered to contain a cross-site scripting XSS vulnerability via /mc-admin/page-edit.php...
CVE-2022-29434
Insecure Direct Object References IDOR vulnerability in Spiffy Plugins Spiffy Calendar = 4.9.0 at WordPress allows an attacker to edit or delete events...
CVE-2022-23378
A Cross-Site Scripting XSS vulnerability exists within the 3.2.2 version of TastyIgniter. The "items%5B0%5D%5Bpath%5D" parameter of a request made to /admin/allergens/edit/1 is vulnerable...
Cross-site Scripting (XSS) - Stored in microweber/microweber
Description There is a reflected XSS in creating and searching tag function . where any user can execute any malicious code results in the cookie stealing or Account takeover vulnerability Steps to Produce: Go to this particular URL URL Click on live edit , Now In the tag section and select the...
CVE-2022-24219
eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/editpage.php...
CVE-2022-24220
eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/editpost.php...
CVE-2022-24222
eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edituser.php...
CVE-2022-24220
eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/editpost.php...
CVE-2022-24222
eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edituser.php...
CVE-2022-24222
The CVE-2022-24222 entry concerns eliteCMS v1.0 with a SQL injection vulnerability in the admin path (/admin/edit_user.php). The issue allows remote attackers to submit a crafted SQL request to manipulate the database, obtain sensitive information, or execute arbitrary code, as described across m...
Elite Graphix Elite Cms SQL注入漏洞
Elite Graphix Elite Cms is a web content management written in Php language from Elite Graphix India. platform for storing and organizing information and documents. Elite Graphix Elite Cms suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL...
Elite Graphix Elite Cms SQL注入漏洞
eliteCMS is a popular content management system. A SQL injection vulnerability exists in eliteCMS /admin/edituser.php, which can be exploited by remote attackers to submit a special SQL request to manipulate the database, obtain sensitive information or execute arbitrary code...
Elite Graphix Elite Cms SQL注入漏洞
Elite Graphix Elite Cms is a web content management written in Php language from Elite Graphix India. platform for storing and organizing information and documents. Elite Graphix Elite Cms suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL...