385 matches found
Zinc delete user function cross-site scripting vulnerability
Zinc is a full-text indexing search engine open sourced by Zinc Labs. Zinc v0.1.9 and later, v0.3.1 and earlier versions have a cross-site scripting vulnerability that could be exploited by attackers to obtain sensitive information such as user credentials...
CVE-2022-32171
In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s...
Cross site scripting
In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s...
CVE-2022-32171 Zinc - Stored XSS
In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s...
PT-2022-21134 · Zinc · Zinc
Name of the Vulnerable Software and Affected Versions: Zinc versions v0.1.9 through v0.3.1 Description: The issue is related to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript...
CVE-2022-36499
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function DEleteusergroup...
CVE-2022-36520
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function DEleteusergroup...
CVE-2022-36520
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function DEleteusergroup...
H3C Magic NX18 Plus 缓冲区错误漏洞
The H3C Magic NX18 Plus is a Gigabit dual-band router from China's Xinhua San H3C. A security vulnerability exists in the H3C Magic NX18 Plus NX18PV100R003 version, which stems from a stack overflow issue in the DEleteusergroup method...
H3C GR-1200W 缓冲区错误漏洞
The H3C GR-1200W is a Gigabit enterprise wireless router from China's Xinhua San H3C. A security vulnerability exists in the H3C GR-1200W MiniGRW1A0V100R006 version that stems from a stack overflow in the DEleteusergroup method...
Kirby 跨站请求伪造漏洞
Kirby is a file-based content management system CMS. A security vulnerability exists in Kirby version 2.5.12, which can be exploited to force the deletion of a user's page by a remote attacker who can craft a malicious CSRF page that utilizes its "delete" page feature...
Gym Management System 安全漏洞
Gym Management System is a gym management system. The system is developed in C and sql server and features customer and vendor management, product management, sales management, gym membership management, fitness assessment, system logging, database backup and restore. A security vulnerability...
CVE-2022-31484
An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29. The impact of...
TeamPass Improper Privilege Management
TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. It is then possible for a manager user to delete an arbitrary user including admin, or modify attributes of any arbitrary user except administrator. To exploit the vulnerability, an...
CVE-2022-28439
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&&action=delete&userid=4...
PT-2022-2038 · Moodle +2 · Moodle +2
Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: The issue is related to insufficient capability checks in Moodle, which could allow users with the moodle/site:uploadusers capability to delete users without having the necessary...
CVE-2022-23887
YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily delete user accounts via /admin/adminmanage/delete...
Cross site request forgery (csrf)
YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily delete user accounts via /admin/adminmanage/delete...
YzmCMS 跨站请求伪造漏洞
Yzmcms is an open source CMS Content Management System for Yzmcms individual developers. yzmCMS v6.3 has a cross-site request forgery vulnerability that allows attackers to arbitrarily delete user accounts via /admin/adminmanage/delete. No details of the vulnerability are currently available...
