CVE-2020-23342: Cross-Site Request Forgery (CSRF)

A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users...

PT-2021-10883

Name of the Vulnerable Software and Affected Versions Anchor CMS version 0.12.7 Description A CSRF issue exists in the anchor/views/users/edit.php file of Anchor CMS, allowing the deletion of admin users. Recommendations For Anchor CMS version 0.12.7, consider disabling the edit user functionalit...

Design/Logic Flaw

An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket. permission can access Tickets...

CVE-2020-26028

An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket. permission can access Tickets...

CVE-2020-26028: Incorrect Authorization

An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket. permission can access Tickets...

PT-2020-16265

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 3.4.1 Description An issue was discovered where Admin Users without a ticket. permission can access Tickets. Recommendations For versions prior to 3.4.1, update to version 3.4.1 or later to resolve the issue...

Online Learning Management System 1.0 - Multiple Stored XSS

Exploit Title: Online Learning Management System 1.0 - Multiple Stored XSS Exploit Author: Aakash Madaan Godsky Date: 2020-12-22 Vendor Homepage: https://www.sourcecodester.com/php/7339/learning-management-system.html Software Link:...

CVE-2020-23837

A Cross-Site Request Forgery CSRF vulnerability in the Multi User plugin 1.8.2 for GetSimple CMS allows remote attackers to add admin or other users after an authenticated admin visits a third-party site or clicks on a URL...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF vulnerability in the Multi User plugin 1.8.2 for GetSimple CMS allows remote attackers to add admin or other users after an authenticated admin visits a third-party site or clicks on a URL...

CVE-2020-23837

A Cross-Site Request Forgery CSRF vulnerability in the Multi User plugin 1.8.2 for GetSimple CMS allows remote attackers to add admin or other users after an authenticated admin visits a third-party site or clicks on a URL...

CVE-2020-12816

An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authenticated attacker to perform a stored cross site scripting attack XSS via the UserID of Admin Users...

CVE-2020-12816

An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authenticated attacker to perform a stored cross site scripting attack XSS via the UserID of Admin Users...

CVE-2020-12816: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authenticated attacker to perform a stored cross site scripting attack XSS via the UserID of Admin Users...

Selection of Accounts with more than one Store in Workspace App is not getting retained

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. If you select All accounts from the UI of the CWA for Windows for version 1909 or higher, the...

PT-2020-6789

Name of the Vulnerable Software and Affected Versions FortiNAC versions prior to 8.7.2 Description The issue is related to an improper neutralization of input, which may allow a remote authenticated attacker to perform a stored cross-site scripting attack XSS via the UserID of Admin Users. This...

Ecommerce CodeIgniter Bootstrap Cross-Site Scripting Vulnerability (CNVD-2020-51509)

Bootstrap is an open source web front-end framework developed using HTML, CSS and JavaScript.CodeIgniter is an open source web framework written using the PHP language . A cross-site scripting vulnerability exists in application/modules/admin/views/advancedsettings/adminUsers.php in...

CVE-2020-6312

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, versions - 4.1, 4.2, allows an attacker with a non-administrative user account that can edit certain web page properties, can modify how a browser processes particular page elements, leading to stored Cross Site...

CVE-2020-14043

PRODUCT NOT SUPPORTED WHEN ASSIGNED A Cross Side Request Forgery CSRF vulnerability was found in Codiad v1.7.8 and later. The request to download a plugin from the marketplace is only available to admin users and it isn't CSRF protected in components/market/controller.php. This might cause admins...

WP Customer Reviews < 3.4.3 - Multiple Unauthenticated and Low Priv Authenticated Stored XSS

Multiple stored cross-site scripting vulnerabilities in WP Customer Reviews 3.4.2 and lower allow remote attackers to inject arbitrary JavaScript code or HTML. PoC If WP Customer Reviews is enabled on a page, an unauthenticated attacker can exploit XSS via review form's parameters: - Reviewer Nam...

Design/Logic Flaw

Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13 and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 does not restrict non administrative users from gaining access to the operating system and editing the application startup script. Successful exploitation of this vulnerability may allow an...