32 matches found
CVE-2022-29647
An issue was discovered in MCMS 5.2.7. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do...
CVE-2021-43738: Cross-Site Request Forgery (CSRF)
An issue was discovered in xiaohuanxiong CMS 5.0.17. There is a CSRF vulnerability that can that can add the administrator account...
PT-2022-11903
Name of the Vulnerable Software and Affected Versions xiaohuanxiong CMS version 5.0.17 Description An issue was discovered in the software, which is a CSRF vulnerability. This vulnerability can be exploited to add an administrator account. Recommendations For xiaohuanxiong CMS version 5.0.17, as ...
CVE-2020-20593: Cross-Site Request Forgery (CSRF)
A cross-site request forgery CSRF in Rockoa v1.9.8 allows an authenticated attacker to arbitrarily add an administrator account...
CVE-2020-20671: Cross-Site Request Forgery (CSRF)
A cross-site request forgery CSRF in KiteCMS V1.1 allows attackers to arbitrarily add an administrator account...
CVE-2020-22403
Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...
PT-2020-17312
Name of the Vulnerable Software and Affected Versions CXUUCMS V3 version 3.1 Description The issue allows an attacker to add an administrator account via a CSRF vulnerability. This can be exploited through the "admin.php?c=adminuser&a=add" endpoint. Recommendations For CXUUCMS V3 version 3.1, as ...
CVE-2019-1010095
DomainMOD v4.10.0 is affected by: Cross Site Request Forgery CSRF. The impact is: There is a CSRF vulnerability that can add the administrator account. The component is: admin/users/add.php. The attack vector is: After the administrator logged in, open the html page...
PT-2019-11470
Name of the Vulnerable Software and Affected Versions: OECMS versions prior to v4.3 Description: The issue allows for Cross Site Request Forgery CSRF attacks. This can lead to the victim unintentionally adding an administrator account. The component affected is admincp.php, and the attack vector ...
CVE-2019-1010095: Cross-Site Request Forgery (CSRF)
DomainMOD v4.10.0 is affected by: Cross Site Request Forgery CSRF. The impact is: There is a CSRF vulnerability that can add the administrator account. The component is: admin/users/add.php. The attack vector is: After the administrator logged in, open the html page...
PT-2019-11960
Name of the Vulnerable Software and Affected Versions HYBBS version 2.2 Description An issue was discovered that allows adding an administrator account due to a CSRF vulnerability in the "/?admin/user.html" API endpoint. Recommendations For HYBBS version 2.2, as a temporary workaround, consider...
CVE-2018-17429
CVE-2018-17429 refers to a CSRF vulnerability in JTBC v3.0(C) where requests to /console/account/manage.php?type=action&action=add can be forged to add an administrator account. A remote attacker can exploit this CSRF to elevate privileges by creating a new admin account. The reports in CNVD/othe...
CVE-2018-17429: Cross-Site Request Forgery (CSRF)
/console/account/manage.php?type=action&action=add in JTBC v3.0C has CSRF for adding an administrator account...
Hucart CMS 5.7.4 - Cross-Site Request Forgery (Add Administrator Account)
Hucart CMS 5.7.4 - Cross-Site Request Forgery Add Administrator Account function posturl,fields var p = document.createElement"form"; p.action = url; p.innerHTML = fields; p.target = "self"; p.method = "post"; document.body.appendChildp; p.submit; function csrfhack var fields; fields += ""; field...
Hucart CMS 5.7.4 - Cross-Site Request Forgery (Add Administrator Account)
function posturl,fields var p = document.createElement"form"; p.action = url; p.innerHTML = fields; p.target = "self"; p.method = "post"; document.body.appendChildp; p.submit; function csrfhack var fields; fields += ""; fields += ""; fields += ""; fields += ""; fields += ""; fields += ""; fields ...
PT-2018-15006
Name of the Vulnerable Software and Affected Versions sikcms version 1.1 Description The issue allows for CSRF via the "admin.php?m=Admin&c=Users&a=userAdd" endpoint to add an administrator account. Recommendations For version 1.1, as a temporary workaround, consider disabling access to the...
Cross site request forgery (csrf)
An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do...
CVE-2018-16431: Cross-Site Request Forgery (CSRF)
admin/admin/adminsave.html in YFCMF v3.0 allows CSRF to add an administrator account...
Flexo CMS Cross-Site Request Forgery Vulnerability
Flexo CMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in Flexo CMS version 0.1.6. An attacker can exploit this vulnerability to add an administrator account with the help of the /admin/user/add page...