CVE-2023-2547

The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions...

Design/Logic Flaw

The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions...

CVE-2023-2547

The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions...

CVE-2023-2547: Missing Authorization

The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions...

WordPress Plugin Feather Login Page Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2023-20087 · WordPress · Feather Login Page

Name of the Vulnerable Software and Affected Versions: Feather Login Page plugin for WordPress versions 1.0.7 through 1.1.1 Description: The issue allows authenticated attackers with subscriber-level permissions and above to delete temporary users generated by the plugin due to a missing capabili...

SQL Injection

org.opendaylight.aaa:aaa-idm-store-h2 is vulnerable to SQL Injection attacks. A specifically crafted attack statement through the deleteUser function in UserStore.java allows a malicious user to inject and execute arbitrary SQL queries on the target system, when the /auth/v1/users/ API interface ...

CVE-2022-45931: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection issue was discovered in AAA in OpenDaylight ODL before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/UserStore.java deleteUser function is affected when the API interface /auth/v1/users/ is used...

PT-2022-27690 · Unknown · Opendaylight

Name of the Vulnerable Software and Affected Versions: OpenDaylight versions prior to 0.16.5 Description: A SQL injection issue was discovered in the AAA component of OpenDaylight. The deleteUser function in the UserStore.java file is affected when the API interface "/auth/v1/users/" is used...

OpenDaylight SQL injection vulnerability

OpenDaylight ODL is an open source SDN controller from OpenDaylight Open Source. A security vulnerability exists in versions of OpenDaylight ODL prior to 0.16.5, which originates in its aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/UserStore.java component in the /auth/ v1/user...

Sql injection

Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a SQL injection vulnerability via the 'roleId' parameter of the editRole and deletUser modules...

CVE-2020-23045

Macrob7 Macs Framework Content Management System, version 1.14f, is reported to contain an SQL injection vulnerability in the editRole and deletUser modules triggered by the roleId parameter. The root cause is improper handling of the roleId input leading to SQL injection. No explicit remediation...

Macrob7 Macs Framework Cms SQL Injection Vulnerability

Macrob7 Macs Framework Cms is an open source Cms framework from the personal developer Macdonald Terrence Robinson. version 1.14 of the Macrob7 Macs Framework Content Management System is vulnerable to SQL injection, which allows attackers to SQL injection can be performed via the "roleId"...

Cross site request forgery (csrf)

An issue was discovered in index.php in baijiacms V4 v41420170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser...

CVE-2018-10503

An issue was discovered in index.php in baijiacms V4 v41420170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser...

CVE-2018-10503: Cross-Site Request Forgery (CSRF)

An issue was discovered in index.php in baijiacms V4 v41420170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser...

PT-2018-9924

Name of the Vulnerable Software and Affected Versions: baijiacms V4 version v4 1 4 20170105 Description: An issue in index.php allows for CSRF attacks, enabling unauthorized actions such as adding an administrator account via "op=edituser", changing the administrator password via "op=changepwd", ...

PT-2013-5479

Name of the Vulnerable Software and Affected Versions Atlassian JIRA versions prior to 6.0.5 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the name parameter to the "secure/admin/user/DeleteUser!default.jspa" endpoint. Th...

Phpcms V9 uc api SQL注入漏洞

1.未启用ucenter服务的情况下uckey为空 define'UCKEY', pcbase::loadconfig'system', 'uckey'; 2. deleteuser接口存在SQL注入漏洞，UC算法加密的参数无惧GPC,程序员未意识到$get'ids'会存在SQL注入情况。 public function deleteuser$get,$post pcbase::loadappfunc'global', 'admin'; pcbase::loadappclass'messagequeue', 'admin' , 0; $ids =...

PeopleAggregator 1.2pre6-release-53 - Multiple Remote File Inclusions

PeopleAggregator 1.2pre6-release-53 - Multiple Remote File Inclusions PeopleAggregator 1.2pre6 Multiple Remote File Inclusion Vulnerabilities http://update.peopleaggregator.org/dist/peopleaggregator-1.2pre6-release-53.tar.gz DORK : "copyright 2006 Broadband Mechanics" POC :...