CVE-2020-35972

An issue was discovered in YzmCMS V5.8. There is a CSRF vulnerability that can add member user accounts via member/member/add.html...

CVE-2021-30147

DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts such as adding new manager accounts via admin.php...

Sql injection

PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search parameter that can reveal sensitive information through adding an admin account...

CVE-2020-18129

A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php...

Cross site request forgery (csrf)

app/system/admin/admin/index.class.php in MetInfo 7.0.0beta allows a CSRF attack to add a user account via a doSaveSetup action to admin/index.php, as demonstrated by an admin/?n=admin&c=index&a=doSaveSetup URI...

CVE-2019-17676

app/system/admin/admin/index.class.php in MetInfo 7.0.0beta allows a CSRF attack to add a user account via a doSaveSetup action to admin/index.php, as demonstrated by an admin/?n=admin&c=index&a=doSaveSetup URI...

CVE-2019-16706

kkcms v1.3 has a CSRF vulnerablity that can add an user account via admin/cmsuseradd.php...

EmpireCMS Cross-Site Request Forgery Vulnerability (CNVD-2019-07938)

EmpireCMS Empire Content Management System is an open source content management system CMS. A cross-site request forgery vulnerability exists in EmpireCMS version 7.5. A remote attacker can exploit this vulnerability to add user accounts...

Cross site request forgery (csrf)

A CSRF vulnerability was found in Verydows v2.0 that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit...

CVE-2019-7737

A CSRF vulnerability was found in Verydows v2.0 that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit...

CVE-2018-19561

sikcms 1.1 has CSRF via admin.php?m=Admin&c=Users&a=userAdd to add an administrator account...

Workspace App for iOS - Error 'EAP is activated and not supported on iOS' when connecting through Netscaler Gateway

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Users are unable to connect using Workspace App for iOS through Netscaler Gateway. The connection wi...

Cross site request forgery (csrf)

UsualToolCMS 8.0 allows CSRF for adding a user account via the cmsadmin/aadminx.php?x=a URI...

CVE-2018-17826

HisiPHP 1.0.8 allows CSRF via admin.php/admin/user/adduser.html to add an administrator account. The attacker can then use that account to execute arbitrary PHP code by leveraging app/common/model/AdminAnnex.php to add .php to the default list of allowable file-upload types .jpg, .png, .gif, .jpe...

CVE-2018-16387

An issue was discovered in Elefant CMS before 2.0.5. There is a CSRF vulnerability that can add an account via user/add...

CVE-2018-16387

Elefant CMS prior to version 2.0.5 contains a CSRF vulnerability that can add a user account via the /user/add endpoint. The issue is documented across multiple disclosures (including CVE-2018-16387 and related advisories) and is confirmed by the NVD entry for CVE-2018-16387. The available descri...

Gleez CMS 1.2.0 Cross Site Request Forgery

Exploit Title: Gleez CMS 1.2.0 - Cross-Site Request Forgery Add Admin Date: 2018-08-24 Exploit Author: GunEggWang Vendor Homepage: https://gleezcms.org/ Software Link: https://github.com/gleez/cms Version: 1.2.0 CVE : CVE-2018-15845 Description: There is a CSRF vulnerability that can add an...

Gxlcms Cross-Site Request Forgery Vulnerability

Gxlcms is an enterprise website creation system. A cross-site request forgery vulnerability exists in Gxlcms version 2.0. A remote attacker can exploit this vulnerability to add an administrator account with the help of news/index.php?s=Admin-Admin-Insert URL...

Cross site request forgery (csrf)

MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=adminadmin&a=doaddsave URI...

CVE-2018-14420

MetInfo 6.0.0 is vulnerable to Cross‑Site Request Forgery (CSRF) that allows an attacker to add a user account via a doaddsave action in admin/index.php (example URI: admin/index.php?anyid=47&n=admin&c=admin_admin&a=doaddsave). The root cause is CSRF protection absence for state-changing requests...