PT-2024-38162 · Sourcecodester · Sourcecodester Complaint Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Complaints Report Management System version 1.0 Description: A problematic issue has been found in the system, affecting the processing of the file "/admin/ajax.php?action=save settings". The manipulation of the name argument...

WordPress Plugin user-registration 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

PT-2024-20306 · WordPress · User Registration – Custom Registration Form

Name of the Vulnerable Software and Affected Versions: User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin versions up to, and including, 3.1.5 Description: The issue is related to a missing capability check on the form save action function, allowing...

PT-2024-18716 · WordPress · Foogallery

Name of the Vulnerable Software and Affected Versions: FooGallery plugin for WordPress versions up to and including 2.4.14 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping via the foogallery attachment modal save action...

VvvebJs 安全漏洞

VvvebJs is a drag-and-drop website generator for Givan Personal Developers. A security vulnerability exists in VvvebJs prior to version 1.7.7, which stems from the presence of a Reflective Cross-Site Scripting XSS vulnerability that allows remote attackers to execute arbitrary code and obtain...

PT-2024-22843 · Vvvebjs · Vvvebjs

Name of the Vulnerable Software and Affected Versions: VvvebJs versions prior to 1.7.7 Description: A Reflected Cross-Site Scripting XSS issue allows remote attackers to execute arbitrary code and obtain sensitive information via the action parameter in "save.php". This enables attackers to perfo...

PT-2023-22411 · Unknown · Sentrifugo

Name of the Vulnerable Software and Affected Versions: Sentrifugo version 3.5 Description: The issue allows an authenticated attacker to upload any file without extension filtering through the AssetsController::uploadsaveAction function. Recommendations: For Sentrifugo version 3.5, consider...

Store XSS in Widgets and pages

Description I noticed that you filtered the comment very carefully. But there are still some parts you missed Proof of Concept 1 .Login with admin 2 .Go to "https://demo.instantcms.io/admin/widgets" 3 . Insert payload in Position name and Title test" onmouseover = "alertdocument.cookie 4 .Click...

SUSE CVE-2009-1151

Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action...

SUSE CVE-2015-8377

SQL injection vulnerability in the hostnewgraphssave function in graphsnew.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted serialized data in the selectedgraphsarray parameter in a save action...

SUSE CVE-2015-8604

SQL injection vulnerability in the hostnewgraphs function in graphsnew.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via the cgg parameter in a save action...

Craft CMS Cross-site Scripting (XSS) Vulnerability

index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab...

rConfig 跨站脚本漏洞

rConfig is an open source network configuration management utility. rConfig version 3.9.5 contains a cross-site scripting vulnerability that can be exploited by remote attackers to execute arbitrary JavaScript code by entering a specific payload and saving it...

PT-2020-3996 · Unknown · Responsive Filemanager

Name of the Vulnerable Software and Affected Versions: Responsive Filemanager versions through 9.14.0 Description: An issue was discovered in the ajax calls.php file, specifically in the save img action, where the name parameter lacks validation of the sent extension. This allows for the executio...

SugarCRM WorkFlow PHP Code Injection Vulnerability

SugarCRM versions prior to 7.9.4.0 and 7.11.0.0 suffer from a PHP code injection vulnerability in the WorkFlow module. User input passed through the $POST'basemodule' parameter to the "Save" action of the WorkFlow module is not properly sanitized before being used to write data into the...

CVE-2018-20418

CVE-2018-20418 affects Craft CMS, version 3.0.25. The vulnerability is a cross-site scripting (XSS) flaw in the handling of the title during saving through the admin action endpoint: http://…/admin/actions/entries/save-entry. Saving a new title from the console tab is reported to enable XSS. The ...

CVE-2018-16366

An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=user&do=save allows CSRF...

CVE-2018-10222

An issue was discovered in idreamsoft iCMS V7.0. There is a CSRF vulnerability that can add a Column via /admincp.php?app=articlecategory&do=save&frame=iPHP...

CVE-2018-8767

joyplus-cms 1.6.0 has XSS in manager/adminajax.php?action=save&tab=prevodtype via the tname parameter...

Users with 'Plan Admin' privileges can change Project Name

h3. Summary Users whom have Plan level Admin privileges, but not Project level Admin privileges are able to change the Project name from /chain/admin/config/editChainDetails.action?buildKey=\projkey-\plankey h3. Steps to Reproduce h1. Step 1 Create Project with key TSTPR Create Plan within TSTPR...