GHSA-H65R-8FP8-W7CX phpMyAdmin SQL Injection

In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php. A malicious user with access to the server could create a crafted username, and then...

phpMyAdmin SQL Injection

In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php. A malicious user with access to the server could create a crafted username, and then...

GHSA-4GJV-5JJP-RCGH HashBrown CMS RCE

A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mishandles the URL, repository, username, and password...

HashBrown CMS RCE

A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mishandles the URL, repository, username, and password...

GHSA-HXP8-R9G3-GRFR Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch

Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm...

GHSA-H668-P5HG-7MC5 Jenkins Oracle Cloud Infrastructure Compute Classic Plugin cross-site request forgery vulnerability

Jenkins Oracle Cloud Infrastructure Compute Classic Plugin does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to initiate a connection test to an attacker-specified server with attacker-specified username and password...

Gophish XSS Vulnerability

Gophish through 0.8.0 allows XSS via a username...

GHSA-9H9F-9Q8G-6764 Gophish XSS Vulnerability

Gophish through 0.8.0 allows XSS via a username...

GHSA-X3FR-W7R5-X7RG MediaWiki Incorrect Access Control vulnerability

MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6...

m1k1o Blog v.10 - Remote Code Execution Exploit

Exploit Title: m1k1o's Blog v.10 - Remote Code Execution RCE Authenticated Exploit Author: Malte V Vendor Homepage: https://github.com/m1k1o/blog Software Link: https://github.com/m1k1o/blog/archive/refs/tags/v1.3.zip Version: 1.3 and below Tested on: Linux CVE : CVE-2022-23626 import argparse...

PT-2022-14156

Name of the Vulnerable Software and Affected Versions Home Clean Services Management System version 1.0 Description A critical issue has been discovered, affecting an unknown part of the admin/login.php component. The manipulation of the username argument with a specific input leads to SQL...

SuiteCRM authenticated SQL injection in export functionality

This module exploits an authenticated SQL injection in SuiteCRM in versions before 7.12.6. The vulnerability allows an authenticated attacker to send specially crafted requests to the export entry point of the application in order to retrieve all the usernames and their associated password from t...

Cross site scripting

In Simple Food Website 1.0, a moderation can put the Cross Site Scripting Payload in any of the fields on http://127.0.0.1:1234/food/admin/allusers.php like Full Username, etc .This causes stored xss...

CVE-2022-30015

In Simple Food Website 1.0, a moderation can put the Cross Site Scripting Payload in any of the fields on http://127.0.0.1:1234/food/admin/allusers.php like Full Username, etc .This causes stored xss...

PT-2022-14136

Name of the Vulnerable Software and Affected Versions Badminton Center Management System affected versions not specified Description A problematic issue was found in the Badminton Center Management System, affecting the userlist module at "/bcms/admin/?page=user/list". The manipulation of the...

Badminton Center Management System Cross-site Scripting Vulnerability

Badminton Center Management System is a badminton center management system from Carlo Montero's personal developer. Badminton Center Management System is vulnerable to a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and output for the...

Lumidek Associates Simple Food Website Cross-site Scripting Vulnerability

Lumidek Associates Simple Food Website is Simple Food Website CMS. A cross-site scripting vulnerability exists in Lumidek Associates Simple Food Website 1.0, which stems from a lack of filtering and escaping of field data in food/admin/allusers.php. The vulnerability can be exploited to conduct a...

PT-2022-19971

Name of the Vulnerable Software and Affected Versions Simple Food Website version 1.0 Description The issue allows a moderation to inject a Cross Site Scripting Payload in various fields on the 'http://127.0.0.1:1234/food/admin/all users.php' page, such as the Full Username field, resulting in...

CVE-2022-1817: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, was found in Badminton Center Management System. This affects the userlist module at /bcms/admin/?page=user/list. The manipulation of the argument username with the input 1 leads to an authenticated cross site scripting. Exploit details have...

m1k1o's Blog v.10 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: m1k1o's Blog v.10 - Remote Code Execution RCE Authenticated Date: 2022-01-06 Exploit Author: Malte V Vendor Homepage: https://github.com/m1k1o/blog Software Link: https://github.com/m1k1o/blog/archive/refs/tags/v1.3.zip Version: 1.3 and below Tested on: Linux CVE : CVE-2022-23626...