CVE-2018-14068: Cross-Site Request Forgery (CSRF)

An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add an admin account via admin.php?m=Admin&c=manager&a=add...

PT-2018-12319

Name of the Vulnerable Software and Affected Versions SRCMS version 2.3.1 Description An issue in SRCMS allows for a CSRF vulnerability, enabling the addition of an admin account via the "admin.php?m=Admin&c=manager&a=add" API endpoint. Recommendations For SRCMS version 2.3.1, as a temporary...

PT-2018-12320

Name of the Vulnerable Software and Affected Versions SRCMS version 2.3.1 Description A CSRF issue allows adding a user account via the "admin.php?m=Admin&c=member&a=add" API endpoint. Recommendations For SRCMS version 2.3.1, consider implementing CSRF protection measures to prevent unauthorized...

CVE-2016-9482: Authentication Bypass by Assumed-Immutable Data

Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator panel by navigating directly to /admin.php?mod=admin&func=panel...

PT-2018-5072

Name of the Vulnerable Software and Affected Versions PHP FormMail Generator affected versions not specified Description The issue allows a remote unauthenticated user to bypass authentication and access the administrator panel. This can be achieved by navigating directly to the...

CVE-2018-14014: Cross-Site Request Forgery (CSRF)

In waimai Super Cms 20150505, there is a CSRF vulnerability that can add an admin account via admin.php?m=Member&a=adminadd...

PT-2018-12278

Name of the Vulnerable Software and Affected Versions waimai Super Cms version 20150505 Description The issue allows for the addition of an admin account via the admin.php?m=Member&a=adminadd API endpoint, due to a CSRF vulnerability. Recommendations For waimai Super Cms version 20150505, as a...

CVE-2018-13031

DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account...

CVE-2018-13031

DamiCMS CVE-2018-13031 affects versions 6.0.0 and 6.1.0 . The vulnerability is a Cross-Site Request Forgery (CSRF) on the endpoint admin.php?s=/Admin/doadd, allowing an attacker to add an administrator account. The root cause is insufficient CSRF protection on that admin action; the impact is the...

PT-2018-11548

Name of the Vulnerable Software and Affected Versions DamiCMS versions 6.0.0 through 6.1.0 Description The issue allows for a CSRF attack via the "admin.php?s=/Admin/doadd" endpoint to add an administrator account. Recommendations For DamiCMS versions 6.0.0 through 6.1.0, consider restricting...

CVE-2018-13031: Cross-Site Request Forgery (CSRF)

DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account...

DAMICMS 6.0.0 - Cross-Site Request Forgery (Add Admin)

DAMICMS 6.0.0 - Cross-Site Request Forgery Add Admin history.pushState'', '', '/'...

Design/Logic Flaw

An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the admin.php file of the ./cpshop/ module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack vector of the vulnerability...

CVE-2018-13001

An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the admin.php file of the ./cpshop/ module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack vector of the vulnerability...

CVE-2018-13001

Sandoba CP:Shop v2016.1 contains a cross-site scripting (XSS) vulnerability in the cpshop/admin.php module. The CVE describes a non-persistent XSS that can be triggered via GET parameters (path, search, rename, or dir) and injected into client-side code. Connected sources corroborate the issue ac...

CVE-2018-13001

An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the admin.php file of the ./cpshop/ module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack vector of the vulnerability...

PT-2018-11530

Name of the Vulnerable Software and Affected Versions Sandoba CP:Shop version v2016.1 Description A cross-site scripting XSS issue was found, allowing remote attackers to inject script codes into the client-side of the web application through vulnerable parameters. The attack vector is...

CVE-2018-13001: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the admin.php file of the ./cpshop/ module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack vector of the vulnerability...

CVE-2018-12603

Cross-site request forgery CSRF vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authentication of unspecified users for requests that add administrator users via the s parameter, a related issue to CVE-2018-12114...

CVE-2018-12603: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authentication of unspecified users for requests that add administrator users via the s parameter, a related issue to CVE-2018-12114...