174 matches found
CVE-2023-5159 A User Manager role with user edit permissions could manage/update bots
Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots...
Sql injection
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the userid parameter at admin/index.php?mode=user&action=edit...
SourceCodester E-Commerce System 访问控制错误漏洞
Moosikay E-Commerce System is an e-commerce system by the individual developer Arvin Arandilla. An access control error vulnerability exists in SourceCodester E-Commerce System version 1.0, which stems from a security issue with an unknown function in the file...
PT-2023-17073 · Sourcecodester · Sourcecodester E-Commerce System
Name of the Vulnerable Software and Affected Versions: SourceCodester E-Commerce System version 1.0 Description: A critical issue affects some unknown functionality of the file /ecommerce/admin/user/controller.php?action=edit of the component Username Handler. The manipulation of the USERID...
SUSE CVE-2015-7707
Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp...
CVE-2022-46580
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the usereditpage parameter in the wificaptiveportal function...
PT-2022-27908 · Trendnet · Trendnet Tew755Ap
Name of the Vulnerable Software and Affected Versions: TRENDnet TEW755AP version 1.13B01 Description: A stack overflow issue was discovered, related to the wifi captive portal function, specifically via the user edit page parameter. Recommendations: For TRENDnet TEW755AP version 1.13B01, consider...
TRENDnet TEW-755AP 缓冲区错误漏洞
The TRENDnet TEW-755AP is a router from TRENDnet. The TRENDnet TEW-755AP suffers from a buffer overflow vulnerability that stems from a lack of size checking of input data in the usereditpage parameter of the wificaptiveportal function, which can be exploited by an attacker to execute arbitrary...
CVE-2022-41767
An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. When changes made by an IP address are reassigned to a user using reassignEdits.php, the changes will still be attributed to the IP address on Special:Contributions when doing a range...
PT-2022-26352 · Unknown · Sourcecodester Book Store Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Book Store Management System version 1.0 Description: A problematic vulnerability has been found in the SourceCodester Book Store Management System. This issue affects an unknown part of the file /bsms ci/index.php/user/edit...
Yunjing Digital Technology YJCMS安全漏洞
Yunjing Digital Technology YJCMS is a content management system from Yunjing Digital Technology China. A security vulnerability exists in Yunjing Digital Technology YJCMS v1.0.9, which originates from a security issue in the /index/user/useredit.html component, and can be exploited by an attacker...
PT-2022-27455 · Yjcms · Yjcms
Name of the Vulnerable Software and Affected Versions: YJCMS version 1.0.9 Description: An issue in the "/index/user/user edit.html" component allows unauthenticated attackers to obtain the Administrator account password. Recommendations: For YJCMS version 1.0.9, consider restricting access to th...
Online Pet Shop We App 代码问题漏洞
Online Pet Shop We App is an online pet store web application by Carlo Montero Personal Developer. A security vulnerability exists in Online Pet Shop We App v1.0, which originates from an arbitrary file upload vulnerability via the edit function in the user module. The vulnerability can be...
School Activity Updates with SMS Notification v1.0 SQL注入漏洞
School Activity Updates with SMS Notification is an online activity update with SMS notification from janobe Personal Developer. It is used to ensure that every student receives an SMS notification every time there is an activity in the school. A security vulnerability exists in School Activity...
CVE-2022-36803
The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permission to use the MasterUserEdit API to modify any users role to Super Admin. This vulnerability was reported by Jacob Shafer from Bishop Fox...
CVE-2022-32010
Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/user/index.php?view=edit&id=...
CVE-2022-32010
Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/user/index.php?view=edit&id=...
Sql injection
Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/user/index.php?view=edit&id=...