102 matches found
CVE-2009-1767
CVE-2009-1767 involves admin/edituser.php in the 2daybiz Template Monster Clone, where no administrative authentication is required. This permits remote attackers to modify arbitrary accounts via the parameters loginname, password, email, firstname, and lastname. The NVD lists a CVSSv2 base score...
CVE-2008-0164
Multiple cross-site request forgery CSRF vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to 1 add arbitrary accounts via the joinform page and 2 change the privileges of arbitrary groups via the prefsgroupsoverview page...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to 1 add arbitrary accounts via the joinform page and 2 change the privileges of arbitrary groups via the prefsgroupsoverview page...
CVE-2008-0164
Multiple cross-site request forgery CSRF vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to 1 add arbitrary accounts via the joinform page and 2 change the privileges of arbitrary groups via the prefsgroupsoverview page...
CVE-2008-0164
Multiple cross-site request forgery CSRF vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to 1 add arbitrary accounts via the joinform page and 2 change the privileges of arbitrary groups via the prefsgroupsoverview page...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in admin/admincenter.php in webSPELL 4.01.02 allows remote attackers to assign the superadmin privilege level to arbitrary accounts as administrators via an "update member" action...
CVE-2007-5109
Cross-site request forgery CSRF vulnerability in index.php in FlatNuke 2.6, and possibly 3, allows remote attackers to change the password and privilege level of arbitrary accounts via the user parameter and modified 1 regpass and 2 level parameters in a noneLogin action, as demonstrated by using...
Authentication flaw
admin/ajoutaut.php in JBlog 1.0 does not require authentication, which allows remote attackers to create arbitrary accounts via modified mot and droit parameters...
CVE-2007-3974
admin/ajoutaut.php in JBlog 1.0 does not require authentication, which allows remote attackers to create arbitrary accounts via modified mot and droit parameters...
CVE-2007-3974
CVE-2007-3974 affects JBlog 1.0: vulnerability in admin/ajoutaut.php where no authentication is enforced. This allows remote attackers to create arbitrary user accounts by manipulating the mot and droit parameters. Reported impact per the entry is partial confidentiality, integrity, and availabil...
Sql injection
PostgreSQL 8.1 and probably later versions, when local trust authentication is enabled and the Database Link library dblink is installed, allows remote attackers to access arbitrary accounts and execute arbitrary SQL queries via a dblink host parameter that proxies the connection from 127.0.0.1...
CVE-2006-3206
register.php in Ultimate PHP Board UPB 1.9.6 and earlier allows remote attackers to create arbitrary accounts via the "NR" sequence in the signature field, which is used to separate multiple records...
CVE-2006-3206
The connected sources confirm CVE-2006-3206 affects Ultimate PHP Board (UPB) versions 1.9.6 and earlier, with a vulnerability in register.php. The root cause is that the signature field uses the "[NR]" sequence to separate records, enabling remote attackers to create arbitrary user accounts. The ...
CVE-2005-3687
cancelaccount.php in WHM AutoPilot 2.5.30 and earlier allows remote attackers to cancel requests for arbitrary accounts via a modified c parameter...
Psychoblogger SQL Injection
Psychoblogger is prone to an SQL injection vulnerability. SPDX-FileCopyrightText: 2003 Noam Rathaus Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2005-2489
Web Content Management News System allows remote attackers to create arbitrary accounts and gain privileges via a direct request to Admin/Users/AddModifyInput.php...
CVE-2005-2489
Web Content Management News System allows remote attackers to create arbitrary accounts and gain privileges via a direct request to Admin/Users/AddModifyInput.php...
CVE-2005-2489
The CVE concerns Web Content Management News System. The vulnerability originates from a direct request to Admin/Users/AddModifyInput.php that lets remote attackers create arbitrary user accounts and gain privileges. This implies a bypass of normal authorization checks and potential privilege esc...