Webmin password_change.cgi Backdoor

This module exploits a backdoor in Webmin versions 1.890 through 1.920. Only the SourceForge downloads were backdoored, but they are listed as official downloads on the project's site. Unknown attackers inserted Perl qx statements into the build server's source code on two separate occasions: onc...

Adive Framework 2.0.7 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: Adive Framework 2.0.7 – Cross-Site Request Forgery CSRF Exploit Author: Pablo Santiago Vendor Homepage: https://adive.es Software Link: https://github.com/ferdinandmartin/adive-php7 Version: 2.0.7 Tested on: Windows and Kali lin...

Adive Framework 2.0.7 Cross Site Request Forgery

Exploit Title: Adive Framework 2.0.7 – Cross-Site Request Forgery CSRF Date:02/08/2019. Exploit Author: Pablo Santiago Vendor Homepage: https://adive.es Software Link: https://github.com/ferdinandmartin/adive-php7 Version: 2.0.7 Tested on: Windows and Kali linux CVE :2019-14346 1. Technical...

Adive Framework 2.0.7 - Cross-Site Request Forgery

Exploit Title: Adive Framework 2.0.7 – Cross-Site Request Forgery CSRF Date:02/08/2019. Exploit Author: Pablo Santiago Vendor Homepage: https://adive.es Software Link: https://github.com/ferdinandmartin/adive-php7 Version: 2.0.7 Tested on: Windows and Kali linux CVE :2019-14346 1. Technical...

CVE-2016-10861

Neet AirStream NAS1.1 devices allow CSRF attacks that cause the settings binary to change the AP name and password...

cPanel cross-site scripting vulnerability (CNVD-2019-30473)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in the WHM MySQL Password Change interface in versions prior to cPanel 67.9999.103. T...

CVE-2019-14346

Internal/Views/config.php in Schben Adive 2.0.7 allows admin/config CSRF to change a user password...

Cross site request forgery (csrf)

Internal/Views/config.php in Schben Adive 2.0.7 allows admin/config CSRF to change a user password...

CVE-2017-18471

cPanel before 62.0.4 allows self XSS on the paperlantern password-change screen SEC-197...

CVE-2017-18471

cPanel before 62.0.4 allows self XSS on the paperlantern password-change screen SEC-197...

Default credentials

cPanel before 62.0.4 allows self XSS on the paperlantern password-change screen SEC-197...

CVE-2017-18471

Summary: CVE-2017-18471 affects cPanel versions before 62.0.4. The issue is a self‑XSS vulnerability on the paper_lantern password‑change screen. Affected software/component: cPanel hosting control panel; paper_lantern password‑change UI. Root cause: Self‑XSS due to insufficient input/output hand...

CVE-2017-18408

cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces SEC-282...

CVE-2017-18408

cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces SEC-282...

Cross site scripting

cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces SEC-282...

CVE-2017-18408

CVE-2017-18408 affects cPanel before 67.9999.103, exposing a stored XSS vulnerability in the WHM MySQL Password Change interfaces (SEC-282). Multiple sources confirm the issue and reference the same remediation version 67.9999.103. The root cause is described in CNVD-2019-30473 as inadequate vali...

The vulnerability of the SSL VPN web portal of the operating system FortiOS, related to errors in the authentication mechanism of the web portal, allows a hacker to change the user password of the web portal.

The vulnerability of the SSL VPN web portal of the operating system FortiOS is related to errors in the authentication mechanism of the web portal. Exploiting this vulnerability allows a malicious actor to change the user password of the web portal through HTTP requests...

CVE-2019-14260

On the Alcatel-Lucent Enterprise ALE 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection missing input validation issue in the password change field for the Change Password interface allows an authenticated remote attacker in the same network to trigger OS commands...

Command injection

On the Alcatel-Lucent Enterprise ALE 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection missing input validation issue in the password change field for the Change Password interface allows an authenticated remote attacker in the same network to trigger OS commands...

CVE-2019-14260

On the Alcatel-Lucent Enterprise ALE 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection missing input validation issue in the password change field for the Change Password interface allows an authenticated remote attacker in the same network to trigger OS commands...