Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2024-6160

SQL Injection in MegaBIP

SQL Injection vulnerability in MegaBIP software allows attacker to disclose the contents of the database, obtain session cookies or modify the content of pages. This issue affects MegaBIP software versions through 5.12.1.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Jan Syski
Products
Megabip
CVE-2024-6527

SQL Injection in MegaBIP

SQL Injection vulnerability in parameter "w" in file "druk.php" in MegaBIP software allows unauthorized attacker to disclose the contents of the database and obtain administrator's token to modify the content of pages.  This issue affects MegaBIP software versions through 5.13.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Jan Syski
Products
Megabip
CVE-2024-6662

CSRF in MegaBIP

Websites managed by MegaBIP in versions below 5.15 are vulnerable to Cross-Site Request Forgery (CSRF) as the form available under "/edytor/index.php?id=7,7,0" lacks protection mechanisms. A user could be tricked into visiting a malicious website, which would send POST request to this endpoint. If the victim is a logged in administrator, this could lead to creation of new accounts and granting of administrative permissions.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Jan Syski
Products
Megabip
CVE-2024-6880

CSRF in MegaBIP

During MegaBIP installation process, a user is encouraged to change a default path to administrative portal, as keeping it secret is listed by the author as one of the protection mechanisms.  Publicly available source code of "/registered.php" discloses that path, allowing an attacker to attempt further attacks.   This issue affects MegaBIP software versions below 5.15

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Jan Syski
Products
Megabip
CVE-2025-3893

SQL Injection in MegaBIP

While editing pages managed by MegaBIP a user with high privileges is prompted to give a reasoning for performing this action. Input provided by the the user is not sanitized, leading to SQL Injection vulnerability.  Version 5.20 of MegaBIP fixes this issue.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Jan Syski
Products
Megabip
CVE-2025-3894

Stored XSS in MegaBIP

Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In order to use the editor high privileges are required.   Version 5.20 of MegaBIP fixes this issue.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Jan Syski
Products
Megabip
CVE-2025-3895

Low token entropy in MegaBIP

Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with a queryable value. It allows an unauthenticated attacker who know user login names to brute force these tokens and change account passwords (including these belonging to administrators).  Version 5.20 of MegaBIP fixes this issue.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Jan Syski
Products
Megabip