228 matches found
DEBIAN-CVE-2020-13231
In Cacti before 1.2.11, authprofile.php?action=edit allows CSRF for an admin email change...
CVE-2020-13231
In Cacti before 1.2.11, authprofile.php?action=edit allows CSRF for an admin email change...
UBUNTU-CVE-2020-13231
In Cacti before 1.2.11, authprofile.php?action=edit allows CSRF for an admin email change...
CVE-2020-13231
CVE-2020-13231 affects Cacti prior to 1.2.11, where auth_profile.php?action=edit permits CSRF to change an admin email. The root cause is improper CSRF protection in the affected admin profile edit flow, enabling an attacker to trigger an admin email change without authentication. Impacts include...
PT-2020-13387 · Cacti +3 · Cacti +3
Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.11 Description: The issue allows for a Cross-Site Request Forgery CSRF attack, which can be used to change an admin's email address. This can be achieved through the "auth profile.php?action=edit" endpoint...
CVE-2020-10460
admin/include/operations.php via admin/email-harvester.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject untrusted input inside CSV files via the POST parameter data...
CVE-2020-10411
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/email-harvester.php by adding a question mark ? followed by the payload...
Cross site scripting
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/email-harvester.php by adding a question mark ? followed by the payload...
CVE-2019-15777
The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&adminemail= XSS...
CVE-2019-13056
An issue was discovered in CyberPanel through 1.8.4. On the user edit page, an attacker can edit the administrator's e-mail and password because of the lack of CSRF protection...
Design/Logic Flaw
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.793 Free/Open Source Version and 0.9.8.753 Pro is vulnerable to Stored/Persistent XSS for Admin Email fields on the "CWP Settings "Edit Settings" screen. By changing the email ID to any XSS Payload and clicking on Save Changes, the XSS Payload wi...
CVE-2019-10893
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.793 Free/Open Source Version and 0.9.8.753 Pro is vulnerable to Stored/Persistent XSS for Admin Email fields on the "CWP Settings "Edit Settings" screen. By changing the email ID to any XSS Payload and clicking on Save Changes, the XSS Payload wi...
CVE-2019-10893
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.793 Free/Open Source Version and 0.9.8.753 Pro is vulnerable to Stored/Persistent XSS for Admin Email fields on the "CWP Settings "Edit Settings" screen. By changing the email ID to any XSS Payload and clicking on Save Changes, the XSS Payload wi...
CVE-2019-10893
CVE-2019-10893 affects CentOS Web Panel versions 0.9.8.793 (Free) and 0.9.8.753 (Pro). It is a stored/persistent XSS in the Admin Email field on the CWP Settings > Edit Settings screen, triggered by saving a crafted email value, with the payload executing in the admin context. Root cause state...
CVE-2019-10893
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.793 Free/Open Source Version and 0.9.8.753 Pro is vulnerable to Stored/Persistent XSS for Admin Email fields on the "CWP Settings "Edit Settings" screen. By changing the email ID to any XSS Payload and clicking on Save Changes, the XSS Payload wi...
CentOS Web Panel 0.9.8.793 (Free) / 0.9.8.753 (Pro) Cross Site Scripting
Exploit Title: CentOS Web Panel v0.9.8.793 Free and v0.9.8.753 Pro - Email Field Stored Cross-Site Scripting Vulnerability Google Dork: N/A Date: 06 - April - 2019 Exploit Author: DKM Vendor Homepage: http://centos-webpanel.com Software Link: http://centos-webpanel.com Version: v0.9.8.793 Free an...
CentOS Web Panel 0.9.8.793 (Free) / 0.9.8.753 (Pro) - Cross-Site Scripting
Exploit Title: CentOS Web Panel v0.9.8.793 Free and v0.9.8.753 Pro - Email Field Stored Cross-Site Scripting Vulnerability Google Dork: N/A Date: 06 - April - 2019 Exploit Author: DKM Vendor Homepage: http://centos-webpanel.com Software Link: http://centos-webpanel.com Version: v0.9.8.793 Free an...
Moodle 3.x Spam Vulnerability (Mar 2018) - Windows
Unauthenticated users can trigger custom messages to admin via paypal enrol script. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Super Socializer <= 7.10.6 - Authentication Bypass
You can log in to the site with any user if you know the user's email address. // Steps: // Fill this 3 variable var url = 'http://my-site.com/wordpress/', //website url. Closing slash required email = '[email protected]', //The admin email address to exploit nonce = 'e86377d05a'; // View the...
Center for Internet Security CIS-CAT Pro Dashboard Privilege Gain Vulnerability
Center for Internet Security CIS-CAT Pro Dashboard is a set of panels used to display system compliance on a dashboard. An access control error vulnerability exists in versions of Center for Internet Security CIS-CAT Pro Dashboard prior to 1.0.4. An attacker can exploit this vulnerability to gain...