2946 matches found
CVE-2018-16337
An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save...
CVE-2018-16338
An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via admin.php?mod=users and subsequently add a page or menu, or submit a topic...
CVE-2018-16338
An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via admin.php?mod=users and subsequently add a page or menu, or submit a topic...
CVE-2018-16331
admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password...
Cross site request forgery (csrf)
admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password...
CVE-2018-16331
admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password...
CVE-2018-16331
The CVE-2018-16331 entry concerns DamiCMS v6.0.0 where the admin.php?s=/Admin/doedit endpoint is vulnerable to CSRF, enabling an attacker to change the administrator password. The related connected records confirm: (1) affected software and version (DamiCMS 6.0.0), (2) the vulnerability type (CSR...
CVE-2018-16337: Cross-Site Request Forgery (CSRF)
An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save...
CVE-2018-16338: Cross-Site Request Forgery (CSRF)
An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via admin.php?mod=users and subsequently add a page or menu, or submit a topic...
CVE-2018-16331: Cross-Site Request Forgery (CSRF)
admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password...
PT-2018-13494
Name of the Vulnerable Software and Affected Versions DamiCMS version 6.0.0 Description The issue allows for a CSRF attack to change the administrator account's password through the "admin.php?s=/Admin/doedit" endpoint. Recommendations For DamiCMS version 6.0.0, update to a newer version that...
PT-2018-13499
Name of the Vulnerable Software and Affected Versions Cscms version 4.1.8 Description An issue was discovered that allows modification of a website's basic configuration via a CSRF vulnerability. This can be exploited through the "upload/admin.php/setting/save" API endpoint. Recommendations For...
PT-2018-13500
Name of the Vulnerable Software and Affected Versions AuraCMS version 2.3 Description An issue was discovered that allows a CSRF vulnerability, enabling an attacker to change the administrator's password via the "admin.php?mod=users" endpoint and subsequently add a page or menu, or submit a topic...
Design/Logic Flaw
In waimai Super Cms 20150505, there is a CSRF vulnerability that can change the configuration via admin.php?m=Config&a=add...
CVE-2018-16315
CVE-2018-16315 affects waimai Super Cms 20150505 with a CSRF weakness that allows an attacker to alter configuration through admin.php?m=Config&a=add. The CNVD/CVE records describe remote exploitation that enables configuration changes via crafted requests; NVD notes CSRF vector affecting configu...
CVE-2018-16315: Cross-Site Request Forgery (CSRF)
In waimai Super Cms 20150505, there is a CSRF vulnerability that can change the configuration via admin.php?m=Config&a=add...
PT-2018-13484
Name of the Vulnerable Software and Affected Versions waimai Super Cms version 20150505 Description The issue allows for a change in configuration via the admin.php?m=Config&a=add endpoint. This is achieved through a CSRF vulnerability, which can be exploited to modify settings without the user's...
CVE-2018-16237
An issue was discovered in damiCMS V6.0.1. There is Directory Traversal via '|' characters in the s parameter to admin.php, as demonstrated by an admin.php?s=Tpl/Add/id/c:|windows|win.ini URI...
CVE-2018-16237
An issue was discovered in damiCMS V6.0.1. There is Directory Traversal via '|' characters in the s parameter to admin.php, as demonstrated by an admin.php?s=Tpl/Add/id/c:|windows|win.ini URI...
CVE-2018-16238
An issue was discovered in damiCMS V6.0.1. Remote code execution can occur via PHP code in a multipart/form-data POST to the admin.php?s=/Tpl/Update.html URI. For example, this can update the Web/Tpl/default/head.html file...