8008 matches found
GHSA-998M-F2X3-JJQ4 CSRF vulnerability in Jenkins Config File Provider Plugin allows deleting configuration files
Jenkins Config File Provider Plugin 3.7.0 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to delete configuration files corresponding to an attacker-specified ID. This is due to an...
GHSA-8FJ6-PC5R-347Q qcubed SQL injection vulnerability in profile.php via the strQuery parameter
A SQL injection vulnerability in qcubed all versions including 3.1.1 in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request...
Microweber Discloses Sensitive Information
userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request...
Magento 2 Community Edition XSS Vulnerability
A stored cross-site scripting XSS vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user can inject arbitrary Javascript code by manipulating section of a POST request related to customer's email address...
GHSA-985W-MQQP-7287 Magento 2 Community Edition XSS Vulnerability
A stored cross-site scripting XSS vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user can inject arbitrary Javascript code by manipulating section of a POST request related to customer's email address...
CVE-2021-45914
In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator...
Design/Logic Flaw
In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator...
CVE-2021-45914
In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator...
Online Sports Complex Booking System授权问题漏洞
Online Sports Complex Booking System is an online stadium booking system. version 1.0 of the Online Sports Complex Booking System is vulnerable to an authorization issue that could be exploited by attackers to take over a user's account via a specially crafted POST request...
PT-2022-12464 · Luxsoft · Luxcal Web Calendar
Name of the Vulnerable Software and Affected Versions: LuxSoft LuxCal Web Calendar versions prior to 5.2.0 Description: An unauthenticated attacker can manipulate a POST request, allowing the attacker's session to be authenticated as any registered LuxCal user, including the site administrator...
OrangeHRM Cross-Site Scripting Vulnerability (CNVD-2022-68518)
OrangeHRM is a human resource management system HRM from OrangeHRM USA. The system supports personnel information management, leave management, time and attendance management and recruitment management, etc. A cross-site scripting vulnerability exists in OrangeHRM v4.10.1, which stems from a lack...
CVE-2022-28993
Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request...
CVE-2022-28992
A Cross-Site Request Forgery CSRF in Online Banquet Booking System v1.0 allows attackers to change admin credentials via a crafted POST request...
CVE-2022-28993
Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request...
CVE-2022-28106
Online Sports Complex Booking System v1.0 was discovered to allow attackers to take over user accounts via a crafted POST request...
CVE-2022-28993
Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request...
CVE-2022-28992
A Cross-Site Request Forgery CSRF in Online Banquet Booking System v1.0 allows attackers to change admin credentials via a crafted POST request...
Cross site request forgery (csrf)
Online Sports Complex Booking System v1.0 was discovered to allow attackers to take over user accounts via a crafted POST request...