Webmin < 1.974 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.974. It is, therefore, affected by multiple vulnerabilities. - A Cross Site Request Forgery CSRF that allow to achieve Remote Command Execution RCE through Webmin running process feature. - A...

Drupal 10.0.x < 10.0.2 Information Disclosure

According to its self-reported version, the instance of Drupal running on the remote web server is 9.4.x prior to 9.4.10, 9.5.x prior to 9.5.2, or 10.0.x prior to 10.0.2. It is, therefore, affected by an information disclosure vulnerability in the Media Library module. Note that the scanner has n...

Apache Spark 3.3.0 Stored Cross-Site Scripting

A stored cross-site scripting XSS vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI. Note that the...

Kibana 7.7.0 < 7.17.1 Insufficient Authorization

According to its self-reported version number, the Kibana application running on the remote host is 7.7.0 prior to 7.17.1 or 8.0.0. It is, therefore, affected by : - A missing authorization issue in which users with read access to the Uptime feature could modify alerting rules CVE-2022-23709 Note...

Kibana 7.x < 7.13.0 Open Redirect

According to its self-reported version number, the Kibana application running on the remote host is prior to 6.8.16 or 7.0.0 prior to 7.13.0. It is, therefore, affected by : - An Open Redirect through a maliciously crafted URL CVE-2021-22141 Note that the scanner has not tested for these issues b...

PHP 8.1.x < 8.1.14 Integer Overflow

According to its self-reported version number, the version of PHP installed on the remote host is 8.0.x prior to 8.0.27, 8.1.x prior to 8.1.14, or 8.2.x prior to 8.2.1. It is, therefore, affected by an integer overflow. Note that the scanner has not tested for these issues but has instead relied...

Elementor Plugin for WordPress < 3.6.3 Incorrect Authorization

The WordPress pElementor Plugin installed on the remote host is affected by an Incorrect Authorization check. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

phpMyAdmin 4.9.x < 4.9.10 Information Disclosure

The version of phpMyAdmin installed on the remote web server is 4.9.x prior to 4.9.10 or 5.1.x prior to 5.1.3. It is, therefore, affected by an information disclosure that would reveal the path on disk where phpMyAdmin is running from. Note that the scanner has not tested for these issues but has...

WordPress Cron Enabled

The wp-cron.php file is responsible for scheduled events in a WordPress website. By default, when a request is made, WordPress will generate an additional request from it to the wp-cron.php file. By generating a large number of requests to the website, it is therefore possible to make the site...

WordPress Plugins Detected

This is an informational notice that the scanner was able to detect one or more installed WordPress plugins. No source data...

phpMyAdmin 5.1.x < 5.1.3 Information Disclosure

The version of phpMyAdmin installed on the remote web server is 4.9.x prior to 4.9.10 or 5.1.x prior to 5.1.3. It is, therefore, affected by an information disclosure that would reveal the path on disk where phpMyAdmin is running from. Note that the scanner has not tested for these issues but has...

Microsoft Access Database Detected

A Microsoft Access Database file has been detected on the target host. This may expose privileged information or configurations to a malicious actor. No source data...

External URLs

An external URL is an URL for which the Fully Qualified Domain Name FQDN is not the same as the web target URL one. The scanner detected the presence of external URLs on the target web application and have listed them based on two types : URLs with a domain name in common with the web target URL...

Phinx Configuration File Detected

Phinx is an open-source PHP software designed to help developers to quickly create and maintain their SQL databases migrations through PHP code. Phinx uses a configuration file in the project root directory to store the environment and database information. By accessing it, an attacker could...

GLPI < 9.3.4 SQL Injection

GLPI in version 9.3.4 has an unauthenticated SQL Injection via the 'cycle' parameter of the 'unlocktasks.php' page. No source data...

Disclosed European Personal Data Number

A European Personal Data Number EPDN is a personally identifiable number that is issued to a citizen of one of the members or ex-members of the European Union. A stolen or leaked EPDN can lead to a compromise, and/or the theft of the affected individuals identity. WAS has discovered an EPDN locat...

GLPI Default Credentials

The scanner successfully authenticated on the GLPI web application by using predictable credentials on its login form. No source data...

WordPress Post By Email Enabled

WordPress has a core feature and plugins allowing content managers to publish posts on their blogs by sending their articles to a configured email address. The scanner detected that the target WordPress instance has either the core feature or a specific plugin configured. No source data...

DotNetNuke Administration Panel Login Form Detected

DotNetNuke Administration Panel login has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative...

TYPO3 Open Redirection in Login Handling

TYPO3 CMS v6.2.0-6.2.56, 7.0.0-7.6.50, 8.0.0-8.7.39, 9.0.0-9.5.24, 10.0.0-10.4.13, 11.0.0-11.1.0 are susceptible to open redirects in login handling due to improper validation of the HTTP Host header. No source data...