288 matches found
📄 Ivanti Endpoint Manager Mobile 12.5.0.0 Authentication Bypass
Ivanti Endpoint Manager Mobile version 12.5.0.0 authentication bypass proof of concept exploit. !/usr/bin/env python3 Exploit Title: Ivanti Endpoint Manager Mobile 12.5.0.0 - Authentication Bypass Google Dork: inurl:/mifs "Ivanti" OR "EPM" OR "Endpoint Manager" Date: 2025-01-21 Exploit Author: Yo...
CVE-2025-9060 MFlash Remote Code Execution (RCE) after authentication of a user with the "administrator" role
A vulnerability has been found in the MSoft MFlash application that allows execution of arbitrary code on the server. The issue occurs in the integration configuration functionality that is only available to MFlash administrators. The vulnerability is related to insufficient validation of...
CVE-2025-9060 MFlash Remote Code Execution (RCE) after authentication of a user with the "administrator" role
A vulnerability has been found in the MSoft MFlash application that allows execution of arbitrary code on the server. The issue occurs in the integration configuration functionality that is only available to MFlash administrators. The vulnerability is related to insufficient validation of...
Open Source MANO 安全漏洞
Open Source MANO OSM is an open source software for managing and orchestrating future networks from Open Source MANO, Inc. A security vulnerability exists in Open Source MANO OSM versions 14.x and 15.x that stems from an unrestricted administrator authentication attempt that could result in...
CVE-2025-26395
SolarWinds Observability Self-Hosted was susceptible to a cross-site scripting XSS vulnerability due to an unsanitized field in the URL. The attack requires authentication using an administrator-level account and user interaction is required...
Devolutions Server 访问控制错误漏洞
Devolutions Server is an application from Devolutions Canada Inc. which provides a full-featured shared account and password management solution. A security vulnerability exists in Devolutions Server version 2025.1.7.0 and prior versions that stems from improper access control of the user MFA...
CVE-2021-20845
Cross-site request forgery CSRF vulnerability in Unlimited Sitemap Generator versions prior to v8.2 allows a remote attacker to hijack the authentication of an administrator and conduct arbitrary operation via a specially crafted web page...
CVE-2021-20687
Cross-site request forgery CSRF vulnerability in Kagemai 0.8.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors...
CVE-2021-20860
Cross-site request forgery CSRF vulnerability in ELECOM LAN routers WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and...
CVE-2021-20786
Cross-site request forgery CSRF vulnerability in GroupSession GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0 allows a remote attacke...
CVE-2010-3884
Cross-site request forgery CSRF vulnerability in CMS Made Simple 1.8.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that reset the administrative password. NOTE: the provenance of this information is unknown; the details are obtained solely from...
CVE-2012-4280
Multiple cross-site request forgery CSRF vulnerabilities in admin/agenteditor.php in Free Realty 3.1-0.6 allow remote attackers to hijack the authentication of administrators for requests that 1 add an agent via an addagent action or 2 modify an agent...
CVE-2015-1580
Multiple cross-site request forgery CSRF vulnerabilities in the Redirection Page plugin 1.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings or conduct cross-site scripting XSS attacks via the 2 source or 3 redir...
CVE-2019-5979
Cross-site request forgery CSRF vulnerability in Personalized WooCommerce Cart Page 2.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...
CVE-2019-6027
Cross-site request forgery CSRF vulnerability in WP Spell Check 7.1.9 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...
CVE-2019-5960
Cross-site request forgery CSRF vulnerability in WP Open Graph 1.6.1 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...
CVE-2019-5992
Cross-site request forgery CSRF vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...
CVE-2012-5891
Multiple cross-site request forgery CSRF vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 add a user via an add action, 2 change user passwords via a change action, or 3 delete a user v...
CVE-2011-1324
Multiple cross-site request forgery CSRF vulnerabilities in the management screen on Buffalo WHR, WZR2, WZR, WER, and BBR series routers with firmware 1.x; BHR-4RV and FS-G54 routers with firmware 2.x; and AS-100 routers allow remote attackers to hijack the authentication of administrators for...