Ultimate Membership Pro < 8.7 - Cross-Site Request Forgery allowing Arbitrary Account Deletion and Creation

While confirming the issues from https://wpvulndb.com/vulnerabilities/10086 have been remediated, two CSRF issues were identified, allowing attackers to make logged in administrator delete arbitrary accounts, as well as create a new administrator account. Other CSRF may be present but haven't bee...

New Relic: CSTI at Plugin page leading to active stored XSS (Publisher name)

Hey team, I have discovered the CSTI vulnerability at NR single Plugin page leading to stored XSS. To plant the payload you need to publish new plugin using account having the payload inside its name. Below I show you the easiest way to reproduce this using a python script which creates the new...

Bukura App Has Logic Design Flaws

Cloth Warehouse APP is a cloth finding application developed by Guangdong Zhida Textile & Decoration Co. Ltd. specifically for fabric buyers, soft furnishing designers. There is a logical design vulnerability in the Cloth Storage APP, which can be exploited by an attacker to register an arbitrary...

Friend's Home App Has Logic Design Flaws

Friends Home App is a social B&B platform based on acquaintance relationship. There is a logical design vulnerability in the Friend's Home APP, which can be exploited by an attacker to register arbitrary accounts and reset account passwords, leading to account abuse and consumption of service...

Beijing Angdao Network Technology Co., Ltd. money clip APP exists arbitrary account registration vulnerability

Money Clip APP is developed and launched by Beijing Angdao Network Technology Co. Ltd. There is an arbitrary account registration vulnerability in Money Clip APP. The vulnerability is due to the registration account, verification code verification failed to verify the number of times and time to ...

Pivotal Cloud Foundry Runtime cf-release, UAA and Pivotal Cloud Foundry Elastic Runtime Cross-Site Request Forgery Vulnerabilities

Pivotal Cloud Foundry PCF Runtime cf-release and others are products of Pivotal Software, Inc. PCF is an open source Platform-as-a-Service PaaS cloud computing platform that provides container scheduling, continuous delivery, and automated service deployment. cf-release is a release of PCF. UAA i...

4S Circle App has arbitrary account registration vulnerability

4S Circle APP is a handheld tool that connects 4S stores and used car trading. 4S Circle APP has an arbitrary account registration vulnerability. Attackers can register any account by grabbing packets to get the verification code...

Arbitrary Account Registration and Arbitrary Password Reset Vulnerability in Skin Beauty With Heart APP

Beauty with a Purpose App is a skincare app that allows you to test your skin type and learn more about skincare. There is an arbitrary account registration and arbitrary password reset vulnerability in Skin Care APP. Attackers can register any account and reset any password by capturing packets...

Any Account Registration and Any Password Reset Vulnerabilities Exist in Anxiety Companion App

Anxious companion APP is a companion O2O service platform. There are arbitrary account registration and arbitrary password reset vulnerabilities in Anxin escort APP. Attackers can register any account and reset any password by capturing the verification code...

Multiple Vulnerabilities in Photo Composer App

Picture Synthesizer APP is a picture synthesizer mobile software. Picture Synthesizer APP has arbitrary account registration and arbitrary password reset vulnerabilities. An attacker can register any account and reset any password by grabbing packets to get the verification code...

Best Clinical Practice App Has Arbitrary Registration Account and Arbitrary Password Reset Vulnerabilities

The Best Clinical Practice App is an application designed to provide medical practitioners with knowledge of diagnosis and treatment during clinical practice and learning. The Best Clinical Practice APP is vulnerable to arbitrary account registration and arbitrary password reset. An attacker can...

There are logic design flaws in the App of Promotion e-Network.

The App is a comprehensive learning and teaching aid product for high school students that integrates online learning, volunteer application, psychological counseling, and community communication. There is a logic design vulnerability in the Study eNET APP. Attackers can register any account and...

Shenzhen Yuanzheng Technology golo Android APP has arbitrary account login vulnerability

golo APP is a social networking application that uses instant messaging as a communication platform to connect automotive repair technicians with car owners. A vulnerability exists in Shenzhen Yuanzheng Technology's golo Android APP that allows an attacker to log in to any account. An attacker ca...

Override Access Vulnerability in Charging Pile Android App

Charging Pile APP is a software that provides electric vehicle owners with information service on the location, number, type and status of charging piles. The Charging Pile Android APP suffers from an overstepping access vulnerability that allows attackers to view arbitrary account information by...

ManageEngine Password Manager Pro CSRF Vulnerability (Apr 2017)

ManageEngine Password Manager Pro is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

TRSIDS系统任意账户密码重置漏洞

No description provided by source...

YouYaX论坛前台任意账户登入（cookie伪造）漏洞

No description provided by source...

74cms最新版重置任意账号密码

简要描述： 密码重置机制可以绕过，同时可重置任意账号密码 demo测试成功 详细说明： 先看下 \user\usergetpass.php $act = !empty$REQUEST'act' ? trim$REQUEST'act' : 'enter'; $smarty-assign'headernav',"getpass"; if $act=='enter' $smarty-assign'title','找回密码 - '.$CFG'sitename'; $token=substrmd5mtrand100000, 999999, 8,16; //生成token...

CVE-2015-0532

EMC RSA Identity Management and Governance IMG 6.9 before P04 and 6.9.1 before P01 does not properly restrict password resets, which allows remote attackers to obtain access via crafted use of the reset process for an arbitrary valid account name, as demonstrated by a privileged account...

KPPW最新版本(Csrf删除任意帐号/添加管理员)

简要描述： 求高Rank 么么哒 详细说明： http://localhost/KPPW/index.php?do=user&view=message&op=send http://localhost/KPPW/index.php?do=pubtask&id=1&step=step2 收件人填目标用户名 标题随便 内容没有转义 不过过滤了敏感标签和 onerror onload等事件。 先来看第一个删除任意帐号 http://localhost/KPPW/admin/index.php?do=user&view=list&op=del&edituid=5529 GET提交此URL...