fastadmin 跨站脚本漏洞

fastadmin is a web backend development framework based on ThinkPHP and Bootstrap. A cross-site scripting vulnerability exists in fastadmin V1.0.0.20200506beta, which stems from the lack of proper validation of client-side data in WEB applications. An attacker can obtain administrator credentials ...

CVE-2020-25967

The member center function in fastadmin V1.0.0.20200506beta is vulnerable to a Server-Side Template Injection SSTI vulnerability...

CVE-2020-25967

The member center function in fastadmin V1.0.0.20200506beta is vulnerable to a Server-Side Template Injection SSTI vulnerability...

Sql injection

The member center function in fastadmin V1.0.0.20200506beta is vulnerable to a Server-Side Template Injection SSTI vulnerability...

CVE-2020-25967

The CVE refers to fastadmin, version 1.0.0.20200506_beta, with a Server-Side Template Injection (SSTI) in the member center function. The connected records reiterate this SSTI description but do not provide root cause details, affected subcomponents beyond the member center, or any remediation/wo...

CVE-2020-25967

The member center function in fastadmin V1.0.0.20200506beta is vulnerable to a Server-Side Template Injection SSTI vulnerability...

CVE-2020-25967: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The member center function in fastadmin V1.0.0.20200506beta is vulnerable to a Server-Side Template Injection SSTI vulnerability...

Fastadmin Code Injection Vulnerability

fastadmin is a set of website backend development framework based on ThinkPHP and Bootstrap. Fastadmin V1.0.0.20200506 beta has a security vulnerability that can be exploited by attackers to cause server-side template injection SST vulnerability attacks...

CVE-2020-21665

In fastadmin V1.0.0.20191212beta, when a user with administrator rights has logged in, a malicious parameter can be passed for SQL injection in URL /admin/ajax/weigh...

CVE-2020-21665

In fastadmin V1.0.0.20191212beta, when a user with administrator rights has logged in, a malicious parameter can be passed for SQL injection in URL /admin/ajax/weigh...

Sql injection

In fastadmin V1.0.0.20191212beta, when a user with administrator rights has logged in, a malicious parameter can be passed for SQL injection in URL /admin/ajax/weigh...

CVE-2020-21665

In fastadmin V1.0.0.20191212beta, when a user with administrator rights has logged in, a malicious parameter can be passed for SQL injection in URL /admin/ajax/weigh...

CVE-2020-21665

In fastadmin v1.0.0.20191212_beta, authenticated administrators can be vulnerable to SQL injection via a crafted parameter in the URL /admin/ajax/weigh. This CVE (CVE-2020-21665) is documented in multiple sources (NVD, RH Red Hat security page, OSV, CVE listing) with CVSS v2 base score 6.5 (Mediu...

CVE-2020-21665: Improper Neutralization of Special Elements used in an SQL Command

In fastadmin V1.0.0.20191212beta, when a user with administrator rights has logged in, a malicious parameter can be passed for SQL injection in URL /admin/ajax/weigh...

fastadmin SQL Injection Vulnerability

fastadmin is a set of website backend development framework based on ThinkPHP and Bootstrap. A SQL injection vulnerability exists in fastadmin V1.0.0.20191212 beta, which stems from a malicious parameter that can be passed in the URL admin ajax for SQL injection when a user with administrator...

fastadmin SQL Injection Vulnerability

fastadmin is a web backend development framework based on ThinkPHP and Bootstrap. A SQL injection vulnerability exists in fastadmin-tp6 v1.0, which originates in the app management controller Ajax.php file, where the passed table parameters are not filtered. An attacker can exploit this...

CVE-2020-21667

In fastadmin-tp6 v1.0, in the file app/admin/controller/Ajax.php the 'table' parameter passed is not filtered so a malicious parameter can be passed for SQL injection...

CVE-2020-21667

In fastadmin-tp6 v1.0, in the file app/admin/controller/Ajax.php the 'table' parameter passed is not filtered so a malicious parameter can be passed for SQL injection...

Sql injection

In fastadmin-tp6 v1.0, in the file app/admin/controller/Ajax.php the 'table' parameter passed is not filtered so a malicious parameter can be passed for SQL injection...

CVE-2020-21667

CVE-2020-21667 affects fastadmin-tp6 v1.0, where the Ajax.php file’s table parameter is not filtered, enabling SQL injection. The vulnerability arises from unsanitized input passed to the database layer, per multiple connected records (NVD, Red Hat RH, CNVD/CVE listings, GitLab file). Exploitatio...