EUVD-2025-24088

Malicious code in bioql PyPI...

EUVD-2023-39805

Malicious code in bioql PyPI...

CVE-2025-8808

A vulnerability was found in xujeff tianti 天梯 up to 2.3. It has been rated as problematic. This issue affects the function exportOrder of the file /tianti-module-admin/user/ajax/save of the component com.jeff.tianti.controller. The manipulation leads to csv injection. The attack may be initiated...

CVE-2025-8808 xujeff tianti 天梯 com.jeff.tianti.controller save exportOrder csv injection

A vulnerability was found in xujeff tianti 天梯 up to 2.3. It has been rated as problematic. This issue affects the function exportOrder of the file /tianti-module-admin/user/ajax/save of the component com.jeff.tianti.controller. The manipulation leads to csv injection. The attack may be initiated...

CVE-2025-8807: Missing Authorization

A vulnerability was found in xujeff tianti 天梯 up to 2.3. It has been declared as critical. This vulnerability affects unknown code of the file /tianti-module-admin/user/ajax/save. The manipulation leads to missing authorization. The attack can be initiated remotely. The exploit has been disclosed...

PT-2025-32481 · Unknown · Xujeff Tianti 天梯

Name of the Vulnerable Software and Affected Versions: xujeff tianti 天梯 versions prior to 2.3 Description: A critical issue exists in xujeff tianti 天梯, potentially leading to missing authorization. The vulnerability affects unknown code within the /tianti-module-admin/user/ajax/save API endpoint...

CVE-2019-17315

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user...

CVE-2022-47926: Improper Neutralization of Argument Delimiters in a Command

AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/admin/fstdel.inc.php...

CVE-2021-44238

AyaCMS 3.1.2 is vulnerable to Remote Code Execution RCE via /aya/module/admin/usttabe.inc.php,...

CVE-2021-44238

AyaCMS 3.1.2 is vulnerable to Remote Code Execution RCE via /aya/module/admin/usttabe.inc.php,...

PT-2022-12025

Name of the Vulnerable Software and Affected Versions AyaCMS version 3.1.2 Description The issue allows for Remote Code Execution RCE via the "/aya/module/admin/ust tab e.inc.php" API endpoint. Recommendations For AyaCMS version 3.1.2, as a temporary workaround, consider restricting access to the...

PT-2022-12711

Name of the Vulnerable Software and Affected Versions H.H.G Multistore versions 5.1.0 and below Description The issue is related to a SQL injection vulnerability. It can be exploited via the /admin/admin.php?module=admin group edit&agID API endpoint. Recommendations For versions 5.1.0 and below,...

PT-2022-12713

Name of the Vulnerable Software and Affected Versions H.H.G Multistore versions 5.1.0 and below Description The issue is a SQL injection vulnerability. It can be exploited via the "/admin/admin.php?module=admin access group edit&aagID" endpoint, specifically targeting the aagID variable. This...

PT-2020-15727

Name of the Vulnerable Software and Affected Versions EyesOfNetwork versions prior to 5.3-7 Description The issue is related to improper escaping of the username on the "/module/admin logs" API endpoint, which might allow pre-authentication stored XSS during login/logout logs recording...

CVE-2018-19601

Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...

PT-2019-9874

Name of the Vulnerable Software and Affected Versions Rhymix CMS version 1.9.8.1 Description The issue allows for Server-Side Request Forgery SSRF via an SVG upload in the admin module. This can be achieved by accessing the "index.php?module=admin&act=dispModuleAdminFileBox" endpoint with a...

PT-2018-14809

Name of the Vulnerable Software and Affected Versions tianti version 2.3 Description The issue allows remote authenticated users to bypass intended permission restrictions. This is possible by visiting the "tianti-module-admin/user/skin/list" endpoint directly. The UserController.java maps a...

PT-2018-14808

Name of the Vulnerable Software and Affected Versions tianti version 2.3 Description The issue allows remote authenticated users to bypass intended permission restrictions. This can be achieved by visiting the "tianti-module-admin/cms/column/list" endpoint directly, which enables the user to read...

CVE-2018-19109: Direct Request

tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/cms/column/list directly to read the column list page or edit a column...

CVE-2018-19091: Improper Neutralization of Input During Web Page Generation

tianti 2.3 has reflected XSS in the user management module via the tianti-module-admin/user/list userName parameter...