CVE-2013-7476

The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface...

CVE-2013-7476

The connected advisories confirm a CSRF vulnerability in the WordPress Simple Fields plugin prior to version 1.2, affecting the admin interface. Root cause: CSRF in admin actions could allow unauthorized requests when an authenticated admin visits a malicious page. Impact is described in CVE reco...

PT-2019-7025

Name of the Vulnerable Software and Affected Versions simple-fields plugin versions prior to 1.2 Description The issue concerns a CSRF problem in the admin interface of the simple-fields plugin for WordPress. Recommendations For versions prior to 1.2, update to version 1.2 or later to resolve the...

PT-2019-8447

Name of the Vulnerable Software and Affected Versions WordPress responsive-menu plugin versions prior to 3.1.4 Description The issue concerns the lack of a CSRF protection mechanism for the admin interface in the responsive-menu plugin. Recommendations For versions prior to 3.1.4, update the...

CVE-2017-18513: Cross-Site Request Forgery (CSRF)

The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface...

CVE-2013-7476: Cross-Site Request Forgery (CSRF)

The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface...

CVE-2019-14495

webadmin.c in 3proxy before 0.8.13 has an out-of-bounds write in the admin interface...

CVE-2019-14495

webadmin.c in 3proxy before 0.8.13 has an out-of-bounds write in the admin interface...

PT-2019-13721 · 3Proxy +1 · 3Proxy +1

Name of the Vulnerable Software and Affected Versions: 3proxy versions prior to 0.8.13 Description: The issue is related to an out-of-bounds write in the admin interface of the webadmin.c component. Recommendations: For versions prior to 0.8.13, update to version 0.8.13 or later to resolve the...

CVE-2019-14495: Out-of-bounds Write

webadmin.c in 3proxy before 0.8.13 has an out-of-bounds write in the admin interface...

Cross-site Scripting (XSS)

invenio-records is vulnerable to cross-site scripting XSS. When an admin user views a new record uploaded by a user with permission to upload in the admin interface, it directly renders JSON output for the new record, allowing the user to inject and render any arbitrary malicious script to render...

PT-2019-11558

Name of the Vulnerable Software and Affected Versions: GLPI version 9.3.1 Description: The issue affects the /glpi/ajax/getDropDownValue.php endpoint, allowing for Cross Site Scripting XSS attacks. This can lead to privilege escalation and the execution of JavaScript code on the admin interface...

Appointment Hour Booking <= 1.1.45 - Stored Cross-Site Scripting (XSS)

It is possible for an unauthenticated user to inject malicious JavaScript into a booking form, which will then be executed when an authenticated user views the booking in the WordPress admin interface. PoC POST /booking-form/ HTTP/1.1 Host: test.local User-Agent: Mozilla/5.0 Macintosh; Intel Mac ...

Grouptime Teamwire Client Cross-Site Scripting Vulnerability

Grouptime Teamwire Client is an enterprise messaging client application from Grouptime Germany. A cross-site scripting vulnerability exists in the admin interface in Grouptime Teamwire Client. The vulnerability stems from a lack of proper validation of client-side data by the web application. An...

CVE-2018-17560

The CVE affects Grouptime Teamwire Client: on-premises server where the admin interface of version 1.5.1 (before 1.9.0) is vulnerable to stored XSS. Public details consistently map the issue to a lack of proper validation of client-side data, enabling cross-site scripting in the admin UI. All bac...

PT-2019-9503

Name of the Vulnerable Software and Affected Versions Grouptime Teamwire Client versions 1.5.1 through 1.9.0 Grouptime Teamwire Client backend versions prior to prod-2018-11-13-15-00-42 Description The issue affects the admin interface of the Grouptime Teamwire Client, allowing stored XSS attacks...

CVE-2018-17560: Improper Neutralization of Input During Web Page Generation

The admin interface of the Grouptime Teamwire Client 1.5.1 prior to 1.9.0 on-premises messenger server allows stored XSS. All backend versions prior to prod-2018-11-13-15-00-42 are affected...

CVE-2018-16247

YzmCMS 5.1 has XSS via the admin/systemmanage/userconfigadd.html title parameter...

CVE-2018-18802

The Tubigan "Welcome to our Resort" 1.0 software allows CSRF via admin/modusers/controller.php?action=edit...

CVE-2018-18802

CVE-2018-18802 affects the Tubigan “Welcome to our Resort” 1.0 software, with a CSRF flaw that can be exploited via admin/mod_users/controller.php?action=edit. The initial description confirms CSRF as the vulnerability type; Red Hat/NVD entries corroborate this. CVSS metrics are provided: CVSS v2...