7 matches found
CVE-2026-85643: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used...
Cross-site Request Forgery (CSRF)
CMS Made Simple is vulnerable to cross-site request forgery CSRF attacks. A malicious user can hijack the authentication of admins for requests to create accounts through an admin/adduser.php requests...
CVE-2016-7904
CMS Made Simple CVE-2016-7904 is a CSRF in admin/adduser.php that lets an attacker hijack admin authentication to create accounts on versions before 2.1.6. Impact includes unauthorized admin account creation; remediation is to upgrade to 2.1.6 or newer.
CVE-2016-7904
Cross-site request forgery CSRF vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request...
Authentication flaw
MeltingIce File System 1.0 allows remote attackers to bypass application authentication, create new user accounts, and exceed application quotas via a direct request to admin/adduser.php...
