CVE-2023-26689: Incorrect User Management

An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request...

IceCMS security vulnerabilities

IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation by NgShow individual developers. A security vulnerability exists in IceCMS v3.4.7 and earlier versions, which stems from an access control issue that allows an attacker to arbitrarily modify user...

CVE-2024-43693 Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Command Injection

A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary commands...

CVE-2024-8940 Unrestricted Upload of File with Dangerous Type vulnerability on Scriptcase

Vulnerability in the Scriptcase application version 9.4.019, which involves the arbitrary upload of a file via /scriptcase/devel/lib/third/jqueryplugin/jQuery-File-Upload/server/php/ via a POST request. An attacker could upload malicious files to the server due to the application not properly...

CVE-2023-26689

An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request...

CVE-2023-26689

CS-Cart MultiVendor version 4.16.1 is vulnerable to an issue that allows an attacker to alter arbitrary user account profiles by sending a crafted POST request . Exploitation of this vulnerability could lead to unauthorized modification of user data. As a remediation, it is recommended to disable...

CVE-2023-26689

An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request...

CVE-2024-46610

An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, including username and password, via a crafted POST request sent to the endpoint /User/ChangeUser/s in the ChangeUser function in UserController.java...

PT-2024-30620 · Unknown · Progauge Maglink Lx Console

Name of the Vulnerable Software and Affected Versions: ProGauge MAGLINK LX CONSOLE affected versions not specified Description: A specially crafted POST request to the "UTILITY sub-menu" can allow a remote attacker to inject arbitrary commands. This issue affects the ProGauge MAGLINK LX CONSOLE,...

CVE-2024-46610

IceCMS v3.4.7 and earlier has an access control vulnerability allowing an attacker to arbitrarily modify user data (username, password) by sending a crafted POST to /User/ChangeUser/s in ChangeUser() of UserController.java. Connected documents (Red Hat, CNNVD, CVE records, PT-Security) corroborat...

BlackNET 3.7.0.0 Missing Authentication / File Deletion / Traversal Exploit

BlackNET version 3.7.0.0 appears to allow unauthenticated access to modify data and suffers from arbitrary file deletion and directory traversal vulnerabilities while authenticated. Exploit Title: BlackNET - Multiple Vulnerabilities Exploit Author: bRpsd Date: 20/09/2024 Vendor Homepage:...

Server-Side Request Forgery (SSRF)

litellm is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to lack of validation or restriction on the apibase parameter in POST /chat/completions, allowing a malicious user to intercept the OpenAI API key by redirecting requests to their own domain...

CVE-2024-8784: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical was found in QDocs Smart School Management System 7.0.0. Affected by this vulnerability is an unknown functionality of the file /user/chat/mynewuser of the component Chat. The manipulation of the argument users with the input...

UBUNTU-CVE-2024-8124

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior to 17.3.2 which could cause Denial of Service via sending a specific POST request...

CVE-2024-8124

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior to 17.3.2 which could cause Denial of Service via sending a specific POST request...

CVE-2024-45826

CVE-2024-45826 IMPACT Due to improper input validation, a path traversal and remote code execution vulnerability exists when the ThinManager® processes a crafted POST request. If exploited, a user can install an executable file...

CVE-2024-45826 ThinManager® Code Execution Vulnerability

CVE-2024-45826 IMPACT Due to improper input validation, a path traversal and remote code execution vulnerability exists when the ThinManager® processes a crafted POST request. If exploited, a user can install an executable file...

CVE-2024-45826

Rockwell Automation ThinManager has a path traversal leading to remote code execution when processing a crafted POST request. Affected versions: ThinManager 13.1.0–13.1.2 and 13.2.0–13.2.1; upgrade to 13.1.3+ or 13.2.2+ to mitigate. CVSSv3 base score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); CVS...

CVE-2024-45826 ThinManager® Code Execution Vulnerability

CVE-2024-45826 IMPACT Due to improper input validation, a path traversal and remote code execution vulnerability exists when the ThinManager® processes a crafted POST request. If exploited, a user can install an executable file...

Tenda AC15 Command Execution Vulnerability

The Tenda AC15 is a wireless router from the Chinese company Tenda. A command execution vulnerability exists in Tenda AC15 version V15.03.05.20, which stems from the goform/SetIPTVCfg interface failing to properly filter constructed command special characters, commands, etc. This vulnerability ca...