SQL Injection Vulnerability in Tpshop Us***.php Page at Member Information

Tpshop is a set of multi-merchant mode developed by Shenzhen Soleil Networks Limited mall system. A SQL injection vulnerability exists in the member information of the Tpshop Us.php page. Attackers can use the vulnerability to obtain sensitive information in the database...

CVE-2019-12361: Improper Neutralization of Input During Web Page Generation

EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page...

PT-2019-12763

Name of the Vulnerable Software and Affected Versions EmpireCMS version 7.5.0 Description The issue allows for XSS via the from parameter to "e/member/doaction.php". This can be exploited using a CSRF payload to change the dynamic page template. An attacker can resend the...

CVE-2019-12362: Improper Neutralization of Input During Web Page Generation

EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php...

PT-2019-12764

Name of the Vulnerable Software and Affected Versions EmpireCMS version 7.5.0 Description The issue allows for XSS via the HTTP Referer header to the "e/member/doaction.php" endpoint. Recommendations For EmpireCMS version 7.5.0, update to a version that fixes this issue, or as a temporary...

CVE-2018-17843

SQL injection exists in ADD Clicking MLM Software 1.0, Binary MLM Software 1.0, Level MLM Software 1.0, Singleleg MLM Software 1.0, Autopool MLM Software 1.0, Investment MLM Software 1.0, Bidding MLM Software 1.0, Moneyorder MLM Software 1.0, Repurchase MLM Software 1.0, and Gift MLM Software 1.0...

CVE-2018-17843

CVE-2018-17843 describes a SQL injection in multiple MLM software packages (ADD Clicking MLM Software 1.0, Binary MLM Software 1.0, Level MLM Software 1.0, Singleleg MLM Software 1.0, Autopool MLM Software 1.0, Investment MLM Software 1.0, Bidding MLM Software 1.0, Moneyorder MLM Software 1.0, Re...

PT-2019-9527

Name of the Vulnerable Software and Affected Versions ADD Clicking MLM Software version 1.0 Binary MLM Software version 1.0 Level MLM Software version 1.0 Singleleg MLM Software version 1.0 Autopool MLM Software version 1.0 Investment MLM Software version 1.0 Bidding MLM Software version 1.0...

CVE-2018-17843: Improper Neutralization of Special Elements used in an SQL Command

SQL injection exists in ADD Clicking MLM Software 1.0, Binary MLM Software 1.0, Level MLM Software 1.0, Singleleg MLM Software 1.0, Autopool MLM Software 1.0, Investment MLM Software 1.0, Bidding MLM Software 1.0, Moneyorder MLM Software 1.0, Repurchase MLM Software 1.0, and Gift MLM Software 1.0...

Flickr: Improper access control in place for "member only" groups via root.YUI_config.flickr.api.site_key

Researcher identified API endpoint that was not doing sufficient permission validation...

Ultimate Member Plugin for WordPress < 2.0.46 Multiple Vulnerabilities

The WordPress Ultimate Member Plugin installed on the remote host is affected by multiple vulnerabilities : - An arbitrary file read and delete vulnerability. - A Cross-Site Scripting XSS vulnerability exists due to improper validation of user-supplied input in admin dashboard. - A Cross-Site...

WordPress Ultimate Member plugin <= 2.0.45 - Multiple vulnerabilities

Multiple vulnerabilities found by Antony Garand Sucuri team in WordPress Ultimate Member plugin versions = 2.0.45. Solution Update the WordPress Ultimate Member plugin to the latest available version at least 2.0.46...

Ultimate Member < 2.0.46 - Multiple Vulnerabilities

The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...

Msvod 10 Cross Site Request Forgery

Exploit Title: Msvod v10 has a CSRF vulnerability to change user information Date: 2019-04-14 Exploit Author: ax8 Vendor Homepage: https://github.com/Li-Siyuan Software Link: https://www.msvodx.com/ Version: v10 CVE : CVE-2019-11375 Msvod v10 has a CSRF vulnerability to change user information vi...

Msvod 10 - Cross-Site Request Forgery (Change User Information)

Msvod 10 - Cross-Site Request Forgery Change User Information Exploit Title: Msvod v10 has a CSRF vulnerability to change user information Date: 2019-04-14 Exploit Author: ax8 Vendor Homepage: https://github.com/Li-Siyuan Software Link: https://www.msvodx.com/ Version: v10 CVE : CVE-2019-11375...

CVE-2019-11375

Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI...

Design/Logic Flaw

Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI...

CVE-2019-11375

CVE-2019-11375 affects Msvod v10 and describes a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to change user information via the URI /admin/member/edit.html. The Red Hat, ENISA EUVD, Exploit-DB, PacketStorm, and related entries corroborate the core issue: a CSRF flaw en...

CVE-2019-11375: Cross-Site Request Forgery (CSRF)

Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI...

PT-2019-12266

Name of the Vulnerable Software and Affected Versions Msvod version 10 Description The issue allows an attacker to change user information via the "admin/member/edit.html" API endpoint. This is achieved through a CSRF vulnerability, which can be exploited to modify user data without the user's...