PT-2022-12041

Name of the Vulnerable Software and Affected Versions Mini-Inventory-and-Sales-Management-System affected versions not specified Description The issue allows an attacker to update or delete items in the inventory through Cross Site Request Forgery CSRF. To exploit this, the attacker must be logge...

CVE-2021-44321: Cross-Site Request Forgery (CSRF)

Mini-Inventory-and-Sales-Management-System is affected by Cross Site Request Forgery CSRF, where an attacker can update/delete items in the inventory. The attacker must be logged into the application create a malicious file for updating the inventory details and items...

PT-2022-13023

Name of the Vulnerable Software and Affected Versions WP RSS Aggregator versions prior to 4.20 Description The issue arises from the lack of sanitization and escaping of the id parameter in the "wprss fetch items row action" AJAX action, leading to a Reflected Cross-Site Scripting issue. This...

CVE-2022-24337: Incorrect Default Permissions

In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissions...

JetBrains TeamCity 访问控制错误漏洞

JetBrains TeamCity is a distributed build management and continuous integration tool from JetBrains Czech Republic. The tool provides continuous unit testing, code quality analysis, and build issue analysis reporting.A security vulnerability exists in JetBrains TeamCity, which stems from the...

PT-2022-13360

Name of the Vulnerable Software and Affected Versions microweber/microweber versions prior to 1.2.11 Description The issue concerns business logic errors and insecure direct object references in the software. A malicious actor can exploit this to remove items from a victim's cart. Recommendations...

CVE-2022-23378

A Cross-Site Scripting XSS vulnerability exists within the 3.2.2 version of TastyIgniter. The "items%5B0%5D%5Bpath%5D" parameter of a request made to /admin/allergens/edit/1 is vulnerable...

CVE-2022-23378

A Cross-Site Scripting XSS vulnerability exists within the 3.2.2 version of TastyIgniter. The "items%5B0%5D%5Bpath%5D" parameter of a request made to /admin/allergens/edit/1 is vulnerable...

CVE-2022-23378: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability exists within the 3.2.2 version of TastyIgniter. The "items%5B0%5D%5Bpath%5D" parameter of a request made to /admin/allergens/edit/1 is vulnerable...

TastyIgniter 跨站脚本漏洞

TastyIgniter is a free and open source online ordering software based on the Laravel PHP Framework designed for developers and restaurateurs to enjoy life. A cross-site scripting vulnerability exists in TastyIgniter that stems from a cross-site scripting XSS vulnerability in version 3.2.2 of...

PT-2022-15962

Name of the Vulnerable Software and Affected Versions TastyIgniter version 3.2.2 Description A Cross-Site Scripting XSS issue exists. The items%5B0%5D%5Bpath%5D parameter of a request made to "/admin/allergens/edit/1" is vulnerable. Recommendations For version 3.2.2, as a temporary workaround,...

PT-2022-16620

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2021.2 Description The issue allows health items of pull requests to be shown to users who lack appropriate permissions. Recommendations For versions prior to 2021.2, update to version 2021.2 or later to...

PT-2022-6479 · Zabbix +2 · Zabbix +2

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The issue is related to the lack of protection of the web page structure in Zabbix. An authenticated user can create a link with reflected Javascript code for the items' page and send it to...

CVE-2021-25072: Cross-Site Request Forgery (CSRF)

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when deleting items, allowing attacker to make a logged in admin delete arbitrary posts via a CSRF attack...

CVE-2021-43960

Lorensbergs Connect2 3.13.7647.20190 is affected by an XSS vulnerability. Exploitation requires administrator privileges and is performed through the Wizard editor of the application. The attack requires an administrator to go into the Wizard editor and enter an XSS payload within the Page title,...

Cross-Site Request Forgery (CSRF) in thorsten/phpmyfaq

Description Hi there, another CSRF in clearing search items. Proof of Concept 1. Install a local instance of phpmyfaq. 2. Go to this link /phpmyfaq/admin/?action=truncatesearchterms 3. See that all search terms are deleted. Impact This vulnerability is capable of CSRF...

CVE-2021-45471

In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items...

CVE-2021-45471

In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items...

CVE-2021-45471

In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items...

PT-2021-24243 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.38 Description: The issue allows blocked IP addresses to edit EntitySchema items. This is a problem in MediaWiki where blocked users can still make changes to certain items. Recommendations: For MediaWiki version...