CVE-2018-12114

Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts...

CVE-2018-12114

CVE-2018-12114 affects MacCMS 10. A CSRF vulnerability allows an attacker to add administrator user accounts via the request targeting admin.php/admin/admin/info.html. The issue is demonstrated in public references and exploit entries, including an explicit POST form example used to create a new ...

PT-2018-11024

Name of the Vulnerable Software and Affected Versions Maccms version 10 Description The issue allows for CSRF, enabling attackers to add user accounts via the admin.php/admin/admin/info.html endpoint. Recommendations For Maccms version 10, as a temporary workaround, consider restricting access to...

CVE-2018-12114: Cross-Site Request Forgery (CSRF)

Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts...

Cross site request forgery (csrf)

An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker via spear phishing/social engineering, the attacker can change the plugin settings. The function...

CVE-2018-11633: Cross-Site Request Forgery (CSRF)

An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker via spear phishing/social engineering, the attacker can change the plugin settings. The function...

PT-2018-10717

Name of the Vulnerable Software and Affected Versions MULTIDOTS Woo Checkout for Digital Goods plugin version 2.1 Description An issue allows attackers to change plugin settings by tricking an admin user into visiting a crafted URL. The woo checkout settings page function in the file...

PT-2018-10639

Name of the Vulnerable Software and Affected Versions CScms version 4.1 Description A Cross-site request forgery CSRF issue allows remote attackers to change the administrator's username and password via the "admin.php/sys/editpass save" API endpoint. Recommendations For CScms version 4.1, as a...

CVE-2018-11527: Cross-Site Request Forgery (CSRF)

An issue was discovered in CScms v4.1. A Cross-site request forgery CSRF vulnerability in plugins/sys/admin/Sys.php allows remote attackers to change the administrator's username and password via /admin.php/sys/editpasssave...

CVE-2018-11018

PbootCMS v1.0.7 contains a Cross‑Site Request Forgery (CSRF) vulnerability in apps/admin/controller/system/RoleController.php that enables remote attackers to add administrator accounts via admin.php/role/add.html. Affected software: PbootCMS 1.0.7. Root cause: CSRF in role management workflow al...

CVE-2018-11018: Cross-Site Request Forgery (CSRF)

An issue was discovered in PbootCMS v1.0.7. Cross-site request forgery CSRF vulnerability in apps/admin/controller/system/RoleController.php allows remote attackers to add administrator accounts via admin.php/role/add.html...

PT-2018-10242

Name of the Vulnerable Software and Affected Versions PbootCMS version 1.0.7 Description A cross-site request forgery CSRF issue allows remote attackers to add administrator accounts. This is possible due to a vulnerability in the RoleController.php file, specifically when accessing the...

CVE-2018-10234: Improper Neutralization of Input During Web Page Generation

Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=umoptions&section=account page...

PT-2018-9774

Name of the Vulnerable Software and Affected Versions: User Profile & Membership plugin versions prior to 2.0.11 Description: An issue exists in the User Profile & Membership plugin for WordPress, where authenticated cross-site scripting is possible. This is due to a vulnerability in the Account...

PT-2018-9796

Name of the Vulnerable Software and Affected Versions: BEESCMS version 4.0 Description: The issue allows for the addition of an administrator account without proper validation, potentially leading to unauthorized access. This is achieved through the "admin/admin admin.php?nav=list admin user&admi...

Code injection

PbootCMS v0.9.8 allows PHP code injection via an IF label in index.php/About/6.html or admin.php/Site/index.html, related to the parserIfLabel function in \apps\home\controller\ParserController.php...

CVE-2018-10132

PbootCMS v0.9.8 has CSRF via an admin.php/Message/mod/id/19.html?backurl=/index.php request, resulting in PHP code injection in the recontent parameter...

CVE-2018-10133

PbootCMS v0.9.8 allows PHP code injection via an IF label in index.php/About/6.html or admin.php/Site/index.html, related to the parserIfLabel function in \apps\home\controller\ParserController.php...

CVE-2018-10132

CVE-2018-10132 affects PbootCMS v0.9.8. The vulnerability is described as a cross‑site request forgery (CSRF) in admin.php/Message/mod/id/19.html?backurl=/index.php that can cause PHP code injection in the recontent parameter. Connected sources consistently reference the same description. No conc...

PT-2018-9700

Name of the Vulnerable Software and Affected Versions: PbootCMS version 0.9.8 Description: The issue allows for CSRF via an "admin.php/Message/mod/id/19.html?backurl=/index.php" request. This results in PHP code injection in the recontent parameter. Recommendations: For PbootCMS version 0.9.8, as...