CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-49783 – No permission checks for editing/deleting records with CSV import form
https://notcve.org/view.php?id=CVE-2023-49783
23 Jan 2024 — Silverstripe Admin provides a basic management interface for the Silverstripe Framework. In versions on the 1.x branch prior to 1.13.19 and on the 2.x branch prior to 2.1.8, users who don't have edit or delete permissions for records exposed in a `ModelAdmin` can still edit or delete records using the CSV import form, provided they have create permissions. The likelihood of a user having create permissions but not having edit or delete permissions is low, but it is possible. Note that this doesn't affect an... • https://github.com/silverstripe/silverstripe-admin/security/advisories/GHSA-j3m6-gvm8-mhvw • CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46754
https://notcve.org/view.php?id=CVE-2023-46754
26 Oct 2023 — The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values. El panel de administración de Obl.ong anterior a la versión 1.1.2 permite omitir la autorización porque la función OTP de correo electrónico acepta valores numéricos arbitrarios. • https://github.com/obl-ong/admin/releases/tag/v1.1.2 • CWE-863: Incorrect Authorization •
CVSS: 6.1EPSS: 1%CPEs: 9EXPL: 2CVE-2007-6232 – ftp Admin 0.1.0 - Local File Inclusion / Cross-Site Scripting / Authentication Bypass
https://notcve.org/view.php?id=CVE-2007-6232
04 Dec 2007 — Cross-site scripting (XSS) vulnerability in index.php in FTP Admin 0.1.0 allows remote attackers to inject arbitrary web script or HTML via the error parameter in an error page action. Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en index.php en FTP Admin 0.1.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro error en una acción de página de error. • https://www.exploit-db.com/exploits/4681 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •