Design/Logic Flaw

A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an attacker could potentially escalate their privileges...

CVE-2023-37498 HCL Unica Platform is vulnerable to a privilege escalation by unauthorized group assignation

A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an attacker could potentially escalate their privileges...

HCL Unica Platform Security Vulnerability

HCL Technologies HCL Unica Platform is a state-of-the-art enterprise automated marketing platform from HCL Technologies, USA. No manual effort is required to handle routine marketing tasks and capture the most effective leads. A security vulnerability exists in HCL Unica Platform versions prior t...

PT-2023-25995 · Hcl +1 · Hcl Unica Platform +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A user can assign themselves to arbitrary groups by reusing a POST request issued by an administrator, potentially allowing an attacker to escalate their privileges. Recommendations...

Perch CMS 3.2 Cross Site Scripting

Exploit Title: Date: 07/2023 Exploit Author: Andrey Stoykov Version: 3.2 Tested on: Windows Server 2022 Blog: http://msecureltd.blogspot.com XSS 1: File: roles.edit.post.php Line 57: ... error'roleTitle', false;?" label'roleTitle', 'Title'; ? text'roleTitle', $Form-get$details, 'roleTitle'; ?...

CVE-2023-34842

Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /dede/tpl.php...

CVE-2023-34644

Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW3.01B11P204, RG-NBS and RG-S1930 series switches SWITCH3.01B11P218, RG-EG series business VPN routers EG3.01B11P216, EAP and RAP series wireless access points AP3.01B11P218, NBC series wirele...

CVE-2023-33534

A Cross-Site Request Forgery CSRF in Guanzhou Tozed Kangwei Intelligent Technology ZLTS10G software version S10G3.11.6 allows attackers to takeover user accounts via sending a crafted POST request to /goform/goformsetcmdprocess...

CVE-2023-34644

Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW3.01B11P204, RG-NBS and RG-S1930 series switches SWITCH3.01B11P218, RG-EG series business VPN routers EG3.01B11P216, EAP and RAP series wireless access points AP3.01B11P218, NBC series wirele...

CVE-2023-34842

Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /dede/tpl.php...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF in Guanzhou Tozed Kangwei Intelligent Technology ZLTS10G software version S10G3.11.6 allows attackers to takeover user accounts via sending a crafted POST request to /goform/goformsetcmdprocess...

Remote code execution

Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /dede/tpl.php...

Remote code execution

Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW3.01B11P204, RG-NBS and RG-S1930 series switches SWITCH3.01B11P218, RG-EG series business VPN routers EG3.01B11P216, EAP and RAP series wireless access points AP3.01B11P218, NBC series wirele...

CVE-2023-34644

Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW3.01B11P204, RG-NBS and RG-S1930 series switches SWITCH3.01B11P218, RG-EG series business VPN routers EG3.01B11P216, EAP and RAP series wireless access points AP3.01B11P218, NBC series wirele...

CVE-2023-33534

A Cross-Site Request Forgery CSRF in Guanzhou Tozed Kangwei Intelligent Technology ZLTS10G software version S10G3.11.6 allows attackers to takeover user accounts via sending a crafted POST request to /goform/goformsetcmdprocess...

CVE-2023-34842

Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /dede/tpl.php...

Ruijie Networks Product 代码注入漏洞

Ruijie Networks Product is a series of Ruijie wireless products from China-based Ruijie Networks. A security vulnerability exists in the Ruijie Networks Product that originates from an API privilege that allows a remote attacker to escalate via a POST request to /cgi-bin/luci/ and affects the...

Desdev DedeCMS 代码注入漏洞

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has the functions of content publishing, content management, content editing and content retrieval. A security vulnerability exists ...

CVE-2023-33534

A Cross-Site Request Forgery CSRF in Guanzhou Tozed Kangwei Intelligent Technology ZLTS10G software version S10G3.11.6 allows attackers to takeover user accounts via sending a crafted POST request to /goform/goformsetcmdprocess...

Cross-site Scripting in Mingsoft MCMS

A Cross-site Scripting vulnerability has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. Th...