472 matches found
Victor CMS users.php SQL注入漏洞
Victor CMS is an open source content management system from the individual developers of Victor Alagwu in Nigeria. victor CMS has a SQL injection vulnerability in v1.0, which stems from the lack of validation of externally entered SQL statements in database-based applications. An attacker could...
CVE-2021-46459
Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=adduser. These vulnerabilities can be exploited through a crafted POST request via the username, userfirstname,userlastname, or useremail parameters...
CVE-2021-46459
Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=adduser. These vulnerabilities can be exploited through a crafted POST request via the username, userfirstname,userlastname, or useremail parameters...
CVE-2021-46459
CVE-2021-46459 affects Victor CMS v1.0. Multiple SQL injection vulnerabilities exist in the admin/users.php?source=add_user component, exploitable via crafted POST requests to parameters user_name, user_firstname, user_lastname, or user_email. Root cause stated: lack of input validation in SQL st...
CVE-2021-46459: Improper Neutralization of Special Elements used in an SQL Command
Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=adduser. These vulnerabilities can be exploited through a crafted POST request via the username, userfirstname,userlastname, or useremail parameters...
CVE-2021-44949
glFusion CMS 1.7.9 is affected by an access control vulnerability via /publichtml/users.php...
Improper access control
glFusion CMS 1.7.9 is affected by an access control vulnerability via /publichtml/users.php...
CVE-2021-44937
glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /publichtml/users.php. An attacker can register with the mailbox of any user. When users want to register, they will find that the mailbox has been occupied...
CVE-2021-44937
glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /publichtml/users.php. An attacker can register with the mailbox of any user. When users want to register, they will find that the mailbox has been occupied...
CVE-2021-44949: Authorization Bypass Through User-Controlled Key
glFusion CMS 1.7.9 is affected by an access control vulnerability via /publichtml/users.php...
GlFusion Cms 授权问题漏洞
GlFusion Cms is a content management and publishing system. glFusion CMS v1.7.9 is vulnerable to an authorization issue, which can be exploited by attackers via /publichtml/users.php...
CVE-2021-44937: Improper Authentication
glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /publichtml/users.php. An attacker can register with the mailbox of any user. When users want to register, they will find that the mailbox has been occupied...
CVE-2021-40261
Multiple Cross Site Scripting XSS vulnerabilities exist in SourceCodester CASAP Automated Enrollment System 1.0 via the 1 userusername and 2 category parameters in saveclass.php, the 3 firstname, 4 class, and 5 status parameters in studenttable.php, the 6 category and 7 classname parameters in...
CVE-2021-40261: Improper Neutralization of Input During Web Page Generation
Multiple Cross Site Scripting XSS vulnerabilities exist in SourceCodester CASAP Automated Enrollment System 1.0 via the 1 userusername and 2 category parameters in saveclass.php, the 3 firstname, 4 class, and 5 status parameters in studenttable.php, the 6 category and 7 classname parameters in...
miniOrange's Google Authenticator < 5.4.40 - Reflected Cross-Site Scripting
The plugin does not escape the user parameter before outputting it back in an attribute in the dashboard page to confirm the 2FA reset, leading to a Reflected Cross-Site Scripting issue https://example.com/wp-admin/users.php?page=reset&action=resetedit&user="alert/XSS/...
CVE-2021-3294: Improper Neutralization of Input During Web Page Generation
CASAP Automated Enrollment System 1.0 is affected by cross-site scripting XSS in users.php. An attacker can steal a cookie to perform user redirection to a malicious website...
CVE-2021-3294
CVE-2021-3294 concerns the CASAP Automated Enrollment System 1.0. The vulnerability is a Stored Cross-Site Scripting (XSS) in users.php, arising from insufficient validation of user data in the “First Name” field, enabling an attacker to steal cookies and redirect victims to a malicious site. Pub...
CVE-2020-28930: Improper Neutralization of Input During Web Page Generation
A Cross-Site Scripting XSS issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSON EPS TSE Server 8 21.0.11 allows an authenticated attacker to inject a JavaScript payload in the user management page that is executed by an administrator...
Nagios XI users.php do_update_user Stored Cross-Site Scripting
A stored cross-site scripting vulnerability exists in Nagios XI. The vulnerability is due to insufficient validation of the phone parameter in users.php...