183 matches found
CVE-2023-38965
Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI...
PT-2023-23482 · Unknown · Sourcecodester Sales Tracker Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Sales Tracker Management System version 1.0 Description: A vulnerability was found in the system, allowing for cross-site scripting through the manipulation of the firstname, middlename, lastname, and username arguments in the...
CVE-2023-31857
Sourcecodester Online Computer and Laptop Store 1.0 allows unrestricted file upload and can lead to remote code execution. The vulnerability path is /classes/Users.php?f=save...
PT-2023-23492 · Unknown · Sourcecodester Online Computer/Laptop Store
Name of the Vulnerable Software and Affected Versions: Sourcecodester Online Computer and Laptop Store version 1.0 Description: The issue allows unrestricted file upload, which can lead to remote code execution. The vulnerability path is "/classes/Users.php?f=save". Recommendations: For version...
PT-2023-11799 · Flycms · Flycms
Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: A Cross Site Request Forgery CSRF issue allows attackers to add arbitrary administrator accounts via the "system/admin/admin save" endpoint. This can be exploited by attackers to gain unauthorized access to the...
PT-2023-2582 · Sourcecodester · Sourcecodester Simple Mobile Comparison Website
Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Mobile Comparison Website version 1.0 Description: A vulnerability has been found in the processing of the file classes/Master.php?f=save field, specifically with the Field Name argument, which leads to cross-site...
PT-2023-18948 · Sourcecodester · Sourcecodester Service Provider Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Service Provider Management System version 1.0 Description: A critical issue has been found in the HTTP POST Request Handler component, specifically in the /classes/Master.php?f=save service file. The manipulation of the name...
PT-2023-17102 · Sourcecodester · Sourcecodester Automatic Question Paper Generator System
Name of the Vulnerable Software and Affected Versions: SourceCodester Automatic Question Paper Generator System version 1.0 Description: A problematic issue has been found in the system, affecting the processing of the file classes/Master.php?f=save class. The manipulation of the description...
CVE-2022-30842
Covid-19 Travel Pass Management System v1.0 is vulnerable to Cross Site Scripting XSS via /ctpms/classes/Users.php?f=save, firstname...
CVE-2022-30462
Water-billing-management-system v1.0 is affected by: Cross Site Scripting XSS via /wbms/classes/Users.php?f=save, firstname...
Water-billing-management-system 跨站脚本漏洞
Water-billing-management-system is a water billing management system by Carlo Montero Personal Developer. A security vulnerability exists in Water-billing-management-system version 1.0, which originates from a /wbms/classes/Users.php?f=save, firstname stored cross-site scripting XSS attack...
Simple Social Networking Site 跨站脚本漏洞
Simple Social Networking Site is a social networking site by Carlo Montero Personal Developer. A security vulnerability exists in version 1.0 of Simple Social Networking Site, which originates from a /sns/classes/Users.php?f=save, firstname stored cross-site scripting XSS attack...
CVE-2021-40108
An issue was discovered in Concrete CMS through 8.5.5. The Calendar is vulnerable to CSRF. ccmtoken is not verified on the ccm/calendar/dialogs/event/add/save endpoint...
CVE-2021-40108
An issue was discovered in Concrete CMS through 8.5.5. The Calendar is vulnerable to CSRF. ccmtoken is not verified on the ccm/calendar/dialogs/event/add/save endpoint...
PortlandLabs Concrete Cms 跨站请求伪造漏洞
PortlandLabs Concrete Cms is a team-oriented open source content management system for the United States PortlandLabs . A cross-site request forgery vulnerability exists in PortlandLabs Concrete CMS, which stems from a failure to validate CCM tokens when adding a save endpoint to the product's...
CVE-2021-27254
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is not required to exploit this vulnerability. The specific flaw exists within the applysave.cgi endpoint. This issue results from the use of hard-coded...
Munkireport Cross-Site Scripting Vulnerability (CNVD-2020-16631)
Munkireport is a reporting client for munki. A cross-site scripting vulnerability exists in Munkireport versions prior to 5.3.0. An attacker can exploit this vulnerability by injecting javascript into the comment field via the /module/comment/save endpoint...
CVE-2020-10191
An issue was discovered in MunkiReport before 5.3.0. An authenticated actor can send a custom XSS payload through the /module/comment/save endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/controllers/client.php:detail...
CVE-2019-1000003
MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery CSRF vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvgsave that can result in an attacker can modify post data, including embedding javascript. This attack appears to be exploitable via the victim must be...