Publikacje w kolejności czasu

The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. This is due to the feature using a cryptographically weak…

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for…

code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter.

Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the 'docid' parameter at /admin/appointment.php.

dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php.

Fizyczny atak na Entrust nShield umożliwia dostęp do wewnętrznych komponentów bez śladów manipulacji.

Brak uwierzytelnienia w Entrust nShield umożliwia modyfikację firmware'u przez użytkownika z dostępem root.

Fizyczny atak na Chassis Management Board w Entrust nShield umożliwia eskalację uprawnień.

MCP Watch is a comprehensive security scanner for Model Context Protocol (MCP) servers. In 0.1.2 and earlier, the MCPScanner class contains a critical Command Injection vulnerability in the cloneRepo method. The application passes the user-supplied githubUrl argument directly to a system shell via…

Gin-vue-admin is a backstage management system based on vue and gin. In 2.8.6 and earlier, attackers can delete any file on the server at will, causing damage or unavailability of server resources. Attackers can control the 'FileMd5' parameter to delete any file and folder.

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/pages/{page_name}, an editor with only permissions to change basic content on the form is now able to change the functioning of the form…

PublicCMS V5.202506.b is vulnerable to SSRF. in the chat interface of SimpleAiAdminController.

mJobtime 15.7.2 handles authorization on the client side, which allows an attacker to modify the client-side code and gain access to administrative features. Additionally, they can craft requests based on the client-side code to call these administrative functions directly.

A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crafted POST request to the /Default.aspx/update_profile_Server endpoint .

A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the receiverLogin.php component. The application fails to properly sanitize user-supplied input in SQL queries, allowing an attacker to inject arbitrary SQL code. By manipulating the remail and rpassword fields, an…

Nieograniczony upload plików w Mogu Blog umożliwia zdalne wprowadzenie złośliwego kodu.

Wykorzystanie luki w Mogu Blog umożliwia zdalne ataki typu server-side request forgery.

Wstrzyknięcie poleceń w ADSLR NBR1005GPEV2 umożliwia zdalne wykonanie kodu.

Wstrzyknięcie poleceń w ADSLR B-QE2W401 umożliwia zdalne wykonanie kodu.

A flaw has been found in ADSLR NBR1005GPEV2 250814-r037c. This affects the function ap_macfilter_add of the file /send_order.cgi. Executing manipulation of the argument mac can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The…

Wstrzyknięcie poleceń w ADSLR NBR1005GPEV2 umożliwia zdalne wykonanie kodu.

Wstrzyknięcie SQL w Chanjet CRM umożliwia zdalne wykonanie ataku.

Błąd w ZenTao umożliwia zdalne zarządzanie uprawnieniami przez manipulację fileID.

Wstrzyknięcie kodu w taosir WTCMS umożliwia zdalne wykonanie ataku.

Przepełnienie bufora w AIS-catcher umożliwia zdalne wykonanie kodu.