CVE-2021-46459

Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=adduser. These vulnerabilities can be exploited through a crafted POST request via the username, userfirstname,userlastname, or useremail parameters...

CVE-2021-46459: Improper Neutralization of Special Elements used in an SQL Command

Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=adduser. These vulnerabilities can be exploited through a crafted POST request via the username, userfirstname,userlastname, or useremail parameters...

Cross site scripting

Victor CMS 1.0 has Persistent XSS in admin/users.php?source=adduser via the username, userfirstname, or userlastname parameter...

CVE-2020-13427

Victor CMS 1.0 has Persistent XSS in admin/users.php?source=adduser via the username, userfirstname, or userlastname parameter...

CVE-2020-13427: Improper Neutralization of Input During Web Page Generation

Victor CMS 1.0 has Persistent XSS in admin/users.php?source=adduser via the username, userfirstname, or userlastname parameter...

CVE-2018-15713: Improper Neutralization of Input During Web Page Generation

Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php...

Design/Logic Flaw

An issue was discovered in OTCMS 3.61. XSS exists in admin/users.php via these parameters: dataTypeCN dataMode dataModeStr...

CVE-2018-17085

An issue was discovered in OTCMS 3.61. XSS exists in admin/users.php via these parameters: dataTypeCN dataMode dataModeStr...

CVE-2018-17085

CVE-2018-17085 affects OTCMS 3.61. The vulnerability is a cross-site scripting (XSS) flaw in admin/users.php exploitable via the dataTypeCN, dataMode, and dataModeStr parameters. Exploitation status is not documented in the provided materials. The CNVD entry similarly describes an XSS vector in O...

CVE-2018-17085: Improper Neutralization of Input During Web Page Generation

An issue was discovered in OTCMS 3.61. XSS exists in admin/users.php via these parameters: dataTypeCN dataMode dataModeStr...

CVE-2018-7176

FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php aka the "add user" feature of the User Permissions page...

CVE-2018-7176: Cross-Site Request Forgery (CSRF)

FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php aka the "add user" feature of the User Permissions page...

CVE-2018-5690

Cross-site scripting XSS vulnerability in admin/users.php in Dotclear 2.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the nb parameter aka the page limit number...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/users.php in Dotclear 2.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the nb parameter aka the page limit number...

CVE-2018-5690

Cross-site scripting XSS vulnerability in admin/users.php in Dotclear 2.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the nb parameter aka the page limit number...

CVE-2018-5690

CVE-2018-5690 is an XSS vulnerability in Dotclear 2.12.1 affecting the admin/users.php page. The issue occurs when processing the nb parameter (page limit number), allowing remote authenticated users to inject arbitrary web script or HTML. The affected component is the admin interface (users mana...

CVE-2018-5690: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/users.php in Dotclear 2.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the nb parameter aka the page limit number...

CVE-2015-8354

Cross-site scripting XSS vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the refer parameter to wp-admin/users.php...

CVE-2015-8354: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the refer parameter to wp-admin/users.php...

CVE-2017-6446: Improper Neutralization of Input During Web Page Generation

XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters...