662 matches found
CVE-2018-20508
CVE-2018-20508 affects CrashFix 1.0.4 with a SQL Injection vulnerability exploitable via the User[status] parameter. The issue is tied to actionIndex in UserController.php and the protected\models\User.php search() function. The connected documents confirm the vulnerability detail but do not prov...
CVE-2018-20508
CrashFix 1.0.4 has SQL Injection via the Userstatus parameter. This is related to actionIndex in UserController.php, and the protected\models\User.php search function...
CVE-2018-20508: Improper Neutralization of Special Elements used in an SQL Command
CrashFix 1.0.4 has SQL Injection via the Userstatus parameter. This is related to actionIndex in UserController.php, and the protected\models\User.php search function...
CVE-2018-1000870
PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerability in /app/admin/users/print-user.php that can result in Execute code in the victims browser. This attack appear to be exploitable via Attacker change theme parameter in user settings. AdminVictim views user in admin-panel and gets...
CVE-2018-1000870: Improper Neutralization of Input During Web Page Generation
PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerability in /app/admin/users/print-user.php that can result in Execute code in the victims browser. This attack appear to be exploitable via Attacker change theme parameter in user settings. AdminVictim views user in admin-panel and gets...
PT-2018-14722
Name of the Vulnerable Software and Affected Versions AbiSoft Ticketly version 1.0 Description The issue allows remote attackers to create administrator accounts. This can be achieved via an action/add user.php POST request, specifically exploiting the add user functionality. Recommendations For...
PT-2018-14620
Name of the Vulnerable Software and Affected Versions SEMCMS version 3.4 Description A CSRF issue was discovered in the software via the "admin/SEMCMS User.php?Class=add&CF=user" API endpoint. Recommendations For SEMCMS version 3.4, update to a version that includes a fix for this issue, if...
PT-2018-14505
Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.7 Description The issue is related to a security problem where an attacker can inject malicious code. The name parameter in the "dapurappsapp useredit user.php" endpoint is vulnerable. Recommendations For Fiyo CMS version...
CVE-2018-18316
emlog v6.0.0 has CSRF via the admin/user.php?action=new URI...
CVE-2018-18316
emlog v6.0.0 has CSRF via the admin/user.php?action=new URI...
Cross site request forgery (csrf)
emlog v6.0.0 has CSRF via the admin/user.php?action=new URI...
CVE-2018-18316
Affected software: emlog. Vulnerability: CSRF via the admin/user.php?action=new URI in emlog v6.0.0. Root cause/impact: CSRF could allow unauthorized actions; the connected documents only state the CSRF issue with that URI and do not provide deeper technical specifics, affected modules beyond adm...
CVE-2018-18316
emlog v6.0.0 has CSRF via the admin/user.php?action=new URI...
Academic Timetable Final Build 7.0b - Cross-Site Request Forgery (Add Admin) Vulnerability
Exploit for php platform in category web applications Exploit Title: Academic Timetable Final Build 7.0b - Cross-Site Request Forgery Add Admin Dork: N/A Date: 2018-10-13 Exploit Author: Ihsan Sencan Vendor Homepage: http://geoffpartridge.net/ Software Link:...
MaxOn ERP Software 8.x-9.x - nomor SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: MaxOn ERP Software 8.x-9.x - 'nomor' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: http://www.talagasoft.com Software Link: http://demo.maxonerp.com/ Software Download:...
MaxOn ERP Software 8.x / 9.x SQL Injection
Exploit Title: MaxOn ERP Software 8.x-9.x - 'nomor' SQL Injection Dork: N/A Date: 2018-10-15 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.talagasoft.com Software Link: http://demo.maxonerp.com/ Software Download: https://datapacket.dl.sourceforge.net/project/maxon/maxon.rar Version:...
MaxOn ERP Software 8.x-9.x - nomor SQL Injection
MaxOn ERP Software 8.x-9.x - nomor SQL Injection Exploit Title: MaxOn ERP Software 8.x-9.x - 'nomor' SQL Injection Dork: N/A Date: 2018-10-15 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.talagasoft.com Software Link: http://demo.maxonerp.com/ Software Download:...
PT-2018-14400
Name of the Vulnerable Software and Affected Versions emlog version 6.0.0 Description The issue allows for CSRF via the admin/user.php?action=new URI. Recommendations For emlog version 6.0.0, update to a newer version that contains a fix for this issue...
CVE-2018-18316: Cross-Site Request Forgery (CSRF)
emlog v6.0.0 has CSRF via the admin/user.php?action=new URI...
MaxOn ERP Software 8.x-9.x - 'nomor' SQL Injection
Exploit Title: MaxOn ERP Software 8.x-9.x - 'nomor' SQL Injection Dork: N/A Date: 2018-10-15 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.talagasoft.com Software Link: http://demo.maxonerp.com/ Software Download: https://datapacket.dl.sourceforge.net/project/maxon/maxon.rar Version:...