CVE-2020-36065

Cross Site Request Forgery CSRF vulnerability in FlyCms 1.0 allows attackers to add arbitrary administrator accounts via system/admin/adminsave...

sunkaifei FlyCms 跨站请求伪造漏洞

sunkaifei FlyCms is sunkaifei open source application . A similar to Zhihu to Q&A based on the fully open source JAVA language development of social networking site builder . sunkaifei FlyCms version 1.0 security vulnerabilities , the vulnerability stems from the existence of cross-site request...

PT-2023-11799 · Flycms · Flycms

Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: A Cross Site Request Forgery CSRF issue allows attackers to add arbitrary administrator accounts via the "system/admin/admin save" endpoint. This can be exploited by attackers to gain unauthorized access to the...

Online Food Ordering System 代码问题漏洞

Online Food Ordering System is an online food ordering system by Carlo Montero, a personal developer. A security vulnerability exists in Online Food Ordering System v2.0, which is caused by an arbitrary file upload vulnerability in the component /admin/ajax.php?action=savemenu, which can be...

CVE-2023-2523

A vulnerability was found in Weaver E-Office 9.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file App/Ajax/ajax.php?action=mobileuploadsave. The manipulation of the argument uploadquwan leads to unrestricted upload. The attack may be launched...

Weaver E-Office 代码问题漏洞

Weaver E-Office is a collaborative office system from China's Panmicro Technology Weaver. A code issue vulnerability exists in Weaver E-Office version 9.5, which stems from the presence of an unknown function in App/Ajax/ajax.php?action=mobileuploadsave, which leads to unrestricted uploads via th...

PT-2023-2943 · Unknown · Weaver E-Office

Name of the Vulnerable Software and Affected Versions: Weaver E-Office version 9.5 Description: The issue is related to the absence of restrictions on file uploads in the App/Ajax/ajax.php?action=mobile upload save component of the Weaver E-Office platform. This allows a remote attacker to upload...

PT-2023-19498 · Sourcecodester · Sourcecodester Simple Student Information System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Student Information System version 1.0 Description: A problematic issue was found in the system, affecting the /classes/Master.php?f=save course component of the Add New Course feature. The manipulation of the name...

Cross-Site Request Forgery (CSRF)

github.com/phachon/mm-wiki is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists in Save function of user.go which allows an attacker to execute arbitrary code via the system/user/save parameter...

PT-2023-2582 · Sourcecodester · Sourcecodester Simple Mobile Comparison Website

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Mobile Comparison Website version 1.0 Description: A vulnerability has been found in the processing of the file classes/Master.php?f=save field, specifically with the Field Name argument, which leads to cross-site...

PT-2023-19158 · Sourcecodester · Sourcecodester Online Dj Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online DJ Management System version 1.0 Description: A problematic issue has been found in the system, affecting some unknown functionality of the file classes/Master.php?f=save event. The manipulation of the name argument lead...

PT-2023-18948 · Sourcecodester · Sourcecodester Service Provider Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Service Provider Management System version 1.0 Description: A critical issue has been found in the HTTP POST Request Handler component, specifically in the /classes/Master.php?f=save service file. The manipulation of the name...

PT-2023-18773 · Sourcecodester · Sourcecodester Purchase Order Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Purchase Order Management System version 1.0 Description: A problematic issue has been found in the system, affecting an unknown part of the file classes/Master.php?f=save item. The manipulation of the description argument with...

PT-2023-18512 · Sourcecodester · Sourcecodester Online Pizza Ordering System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Pizza Ordering System version 1.0 Description: A critical issue has been found in the SourceCodester Online Pizza Ordering System, affecting the file admin/ajax.php?action=save settings. The manipulation of the img...

Online Pizza Ordering System 代码问题漏洞

Online Pizza Ordering System is an online pizza ordering system. An arbitrary file upload vulnerability exists in Online Pizza Ordering System v1.0, which stems from the parameter img of admin/ajax.php?action=savesettings that lacks validation of the uploaded file. The vulnerability can be...

GHSA-C23V-VQW5-52C5 PowerJob vulnerable to Incorrect Access Control via the create user/save interface.

PowerJob v4.9.3 is vulnerable to Incorrect Access Control via the create user/save interface...

Improper access control

PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface...

CVE-2023-29922

PowerJob V4.3.1 is affected by an Incorrect Access Control vulnerability in the create user/save interface. The root cause is insufficient authorization checks on the /user/save flow, potentially allowing an attacker to bypass authentication and perform unauthorized user creation. Documented deta...

CVE-2023-29922: Improper Access Control

PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface...

BizLibrary <= 1.1 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Login as Admin. 2. Go to...