EUVD-2008-6272

Malware in sbrugna...

EUVD-2021-19550

Malware in sbrugna...

EUVD-2019-4377

Malware in sbrugna...

EUVD-2007-0313

Malware in sbrugna...

EUVD-2021-15586

Malware in sbrugna...

EUVD-2019-7644

Malware in sbrugna...

EUVD-2022-33573

Malicious code in bioql PyPI...

EUVD-2022-45054

Malicious code in bioql PyPI...

CVE-2023-6042

Any unauthenticated user may send e-mail from the site with any title or content to the admin...

CVE-2022-2935

The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media Image URL value that can be added to an Image Hover in versions up to, and including, 9.7.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2022-2937

The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title & Description values that can be added to an Image Hover in versions up to, and including, 9.7.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2021-32787

Sourcegraph is a code search and navigation engine. Sourcegraph before version 3.30.0 has two potential information leaks. The site-admin area can be accessed by regular users and all information and features are properly protected except for daily usage statistics and code intelligence uploads a...

CVE-2019-17226

CMS Made Simple CMSMS 2.2.11 allows XSS via the Site Admin Module Manager Search Term field...

CVE-2019-10106

CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section...

Search API Solr - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-046

This module provides support for creating searches using the Apache Solr search engine and the Search API Drupal module. The module doesn't sufficiently protect certain routes from CSRF attacks. This vulnerability is mitigated by the fact that a site admin would have to perform further steps afte...

CVE-2024-1576 SQL Injection in MegaBIP

SQL Injection vulnerability in MegaBIP software allows attacker to obtain site administrator privileges, including access to the administration panel and the ability to change the administrator password. This issue affects MegaBIP software versions through 5.09...

CVE-2024-3164

In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a system admin, should not have access to the System...

CVE-2023-4820

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin...

GitHub: GHES Management console EoP (editor to site admin)

Improper privilege management in GitHub Enterprise Server allowed editor role users to escalate privileges by making requests to the bootstrapping endpoint...

PT-2023-11567 · Publiccms · Publiccms

Name of the Vulnerable Software and Affected Versions: PublicCMS version 4.0 Description: A SQL Injection issue allows a remote attacker to execute arbitrary code via the sql parameter of the SysSiteAdminControl. Recommendations: For PublicCMS version 4.0, update to a version that includes a fix...