159 matches found
CVE-2023-1031
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the settings endpoint and firstname parameter...
CVE-2023-2246
A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/ajax.php?action=savesettings. The manipulation of the argument img leads to unrestricted upload. The attack can be initiated...
PT-2023-18512 · Sourcecodester · Sourcecodester Online Pizza Ordering System
Name of the Vulnerable Software and Affected Versions: SourceCodester Online Pizza Ordering System version 1.0 Description: A critical issue has been found in the SourceCodester Online Pizza Ordering System, affecting the file admin/ajax.php?action=save settings. The manipulation of the img...
Online Pizza Ordering System 代码问题漏洞
Online Pizza Ordering System is an online pizza ordering system. An arbitrary file upload vulnerability exists in Online Pizza Ordering System v1.0, which stems from the parameter img of admin/ajax.php?action=savesettings that lacks validation of the uploaded file. The vulnerability can be...
PT-2023-16979 · Sourcecodester · Sourcecodester Online Food Ordering System
Name of the Vulnerable Software and Affected Versions: SourceCodester Online Food Ordering System version 2.0 Description: A critical issue was found in the system, affecting some unknown functionality of the file "/fos/admin/ajax.php?action=save settings" of the component POST Request Handler...
PT-2022-27364 · Unknown · Online Leave Management System
Name of the Vulnerable Software and Affected Versions: Online Leave Management System version 1.0 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability at the "/leave system/classes/SystemSettings.php?f=update...
PT-2022-26282 · Unknown · Online Tours & Travels Management System
Name of the Vulnerable Software and Affected Versions: Online Tours & Travels Management System version 1.0 Description: The issue concerns arbitrary code execution. It can be exploited via the "ip/tour/admin/operations/update settings.php" API endpoint. Recommendations: For Online Tours & Travel...
PT-2022-4827 · Syncovery · Syncovery
Name of the Vulnerable Software and Affected Versions: Syncovery versions 9.47x and below Description: The issue is related to remote code execution via the Job ExecuteBefore and Job ExecuteAfter parameters at the "post profilesettings.php" endpoint. It is associated with a lack of data...
PT-2022-21627 · Totolink · Totolink A7000R
Name of the Vulnerable Software and Affected Versions: TOTOLINK A7000R version 4.1cu.4134 Description: The issue is related to an access control problem. It can be exploited via the "/cgi-bin/ExportSettings.sh" API endpoint. Recommendations: For TOTOLINK A7000R version 4.1cu.4134, consider...
PT-2022-23458 · Unknown · Edoc-Doctor-Appointment-System
Name of the Vulnerable Software and Affected Versions: Edoc-doctor-appointment-system version 1.0.1 Description: The Edoc-doctor-appointment-system contains a Cross-Site Request Forgery CSRF issue via the "/patient/settings.php" API endpoint. This allows for potentially malicious requests to be...
SQL Injection in librenms
A second-order SQL injection issue in Widgets/TopDevicesController.php aka the Top Devices dashboard widget of LibreNMS before 21.1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the sortorder parameter against the /ajax/form/widget-settings endpoint...
PT-2020-15561
Name of the Vulnerable Software and Affected Versions Spiceworks versions prior to 7.5.00108 Description The issue allows for privilege escalation via the "/settings/v1/users" API endpoint. This can be exploited due to a CSRF flaw. Recommendations For versions prior to 7.5.00108, update to versio...
CVE-2020-9039
Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer REST endpoints they allow unauthenticated access.The /settings REST endpoint exposed by the projector process is an endpoint that...
PT-2019-13826 · Woo Variation Swatches · Woo-Variation-Swatches
Name of the Vulnerable Software and Affected Versions: Woo-variation-swatches plugin version 1.0.61 Description: The issue allows for XSS via the "tab" parameter in the 'wp-admin/admin.php?page=woo-variation-swatches-settings' endpoint. Recommendations: For version 1.0.61, consider disabling acce...
PT-2018-13897 · Getsimple · Getsimple Cms
Name of the Vulnerable Software and Affected Versions: GetSimple CMS version 3.3.13 Description: An issue was discovered that allows for a CSRF vulnerability, which can change the administrator's password via the "admin/settings.php" endpoint. The vendor reported that the proof of concept was...
Intelbras NCLOUD 300 Denial of Service Vulnerability
Intelbras NCLOUD 300 is a wireless router device from Intelbras, Brazil. A security vulnerability exists in Intelbras NCLOUD 300 version 1.0, which stems from the program failing to require authentication. An attacker can exploit the vulnerability by sending requests to /cgi-bin/ExportSettings.sh...
CVE-2016-10511
The Twitter iOS client versions 6.62 and 6.62.1 fail to validate Twitter's server certificates for the /1.1/help/settings.json configuration endpoint, permitting man-in-the-middle attackers the ability to view an application-only OAuth client token and potentially enable unreleased Twitter iOS ap...
PT-2017-19229 · Sma Solar Technology · Sunny Boy Tlst-21 +3
Name of the Vulnerable Software and Affected Versions: SMA Solar Technology products, specifically Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 Description: An issue in SMA Solar Technology products allows for cross-site request forgery, enabling an attacker to change settings i...
