PT-2019-19329

Name of the Vulnerable Software and Affected Versions S-CMS PHP version 3.0 Description The issue allows for a CSRF attack to add a new admin user via the "admin/ajax.php?type=admin&action=add" API endpoint. Recommendations For S-CMS PHP version 3.0, consider disabling access to the...

Authentication Bypass by Spoofing in express-cart

A deficiency in the access control in module express-cart =1.1.5 allows unprivileged users to add new users to the application as administrators...

CVE-2018-16483: Authentication Bypass by Spoofing

A deficiency in the access control in module express-cart =1.1.5 allows unprivileged users to add new users to the application as administrators...

phpMoAdmin MongoDB GUI 1.1.5 - Cross-Site Request Forgery / Cross-Site Scripting

Exploit Title: phpMoAdmin 1.1.5 - MongoDB GUI | Multiple Vulnerabilities Date: 03.01.2019 Exploit Author: Ozer Goker Vendor Homepage: http://www.phpmoadmin.com Software Link: http://www.phpmoadmin.com/file/phpmoadmin.zip Version: 1.1.5 Introduction phpMoAdmin - MongoDB GUI MongoDB administration...

Cross site request forgery (csrf)

Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request...

CVE-2018-19598

Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request...

CVE-2018-19598

CVE-2018-19598 affects Statamic 2.10.3. A stored/reflected-like XSS exists via the First Name or Last Name fields in an ‘Add new user’ request to the /users URI. Public exploitation details are not provided in the provided documents. No remediation details are included here.

CVE-2018-19598: Improper Neutralization of Input During Web Page Generation

Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request...

CVE-2018-19332

An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add URI...

PT-2018-14921

Name of the Vulnerable Software and Affected Versions S-CMS version 1.5 Description A CSRF issue allows adding a new user via the "admin/ajax.php?type=member&action=add" API endpoint. Recommendations For S-CMS version 1.5, consider implementing proper CSRF protection mechanisms to prevent...

CVE-2018-19332: Cross-Site Request Forgery (CSRF)

An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add URI...

PT-2018-17295

Name of the Vulnerable Software and Affected Versions: Green Electronics RainMachine Mini-8 2nd generation Description: The issue concerns the 'Weather Service' feature, which allows an attacker to inject arbitrary Python code. This is possible via the 'Add new weather data source' upload functio...

Design/Logic Flaw

GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field...

CVE-2018-15843

GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field...

CVE-2018-15843

GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field...

CVE-2018-15843: Improper Neutralization of Input During Web Page Generation

GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field...

PT-2018-13232

Name of the Vulnerable Software and Affected Versions GetSimple CMS version 3.3.14 Description The issue is related to a Cross-Site Scripting XSS problem. It occurs in the admin/edit.php file, specifically through the "Add New Page" field. Recommendations For GetSimple CMS version 3.3.14, update ...

CVE-2018-15202: Cross-Site Request Forgery (CSRF)

An issue was discovered in Juunan06 eCommerce through 2018-08-05. There is a CSRF vulnerability in ee/eBoutique/app/template/includes/crudTreatment.php that can add new users and add products...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15869)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the addnewcontainer method in Quest DR Series disk backup software versions prior to 4.0.3.1. An attacker could exploit this vulnerability to execute commands...

ManageEngine Recovery Manager Plus 5.3 Cross Site Scripting

Exploit Title: ManageEngine Recovery Manager Plus 5.3 Build 5330 - Persistent Cross-Site Scripting Dated: 2018-03-31 Exploit Author: Ahmet GAREL Software Link: https://www.manageengine.com/ad-recovery-manager/ Version: = 5.3 Build 5330 Platform: Java Tested on: Windows CVE: CVE-2018-9163 1. DETAI...