50998 matches found
CVE-2018-10758
The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles...
CVE-2018-14959
An issue was discovered in WeaselCMS v0.3.5. CSRF can create new pages via an index.php?b=pages=new URI...
CVE-2017-9519
atmail before 7.8.0.2 has CSRF, allowing an attacker to create a user account...
CVE-2018-5656
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. CSRF exists via wp-admin/admin-ajax.php...
CVE-2018-20612
UWA 2.3.11 allows index.php?g=admin=admin=addadmindo CSRF...
CVE-2017-7990
The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a name field in webapp/reports/manageReports.jsp...
CVE-2019-15114
The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF...
CVE-2018-21037
Subrion CMS 4.1.5 and possibly earlier versions allow CSRF to change the administrator password via the panel/members/edit/1 URI...
CVE-2017-9518
atmail before 7.8.0.2 has CSRF, allowing an attacker to change the SMTP hostname and hijack all emails...
CVE-2018-11126
dg-user/?controller=users=add in doorGets 7.0 has CSRF that results in adding an administrator account...
CVE-2018-10503
An issue was discovered in index.php in baijiacms V4 v41420170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser...
CVE-2015-9447
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters...
CVE-2018-19560
BageCMS 3.1.3 has CSRF via upload/index.php?r=admini/admin/ownerUpdate to modify a user account...
CVE-2018-15202
An issue was discovered in Juunan06 eCommerce through 2018-08-05. There is a CSRF vulnerability in ee/eBoutique/app/template/includes/crudTreatment.php that can add new users and add products...
CVE-2017-1000224
CSRF in YouTube WordPress plugin could allow unauthenticated attacker to change any setting within the plugin...
CVE-2019-13594
In Mirumee Saleor 2.7.0 fixed in 2.8.0, CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid CSRF token and be accepted by the server...
CVE-2018-13445
An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add a user account via adm1n/adminmanager.php?action=add...
CVE-2017-17830
Bus Booking Script has CSRF via admin/newmaster.php...