CVE-2023-45228 Sielco Radio Link and Analog FM Transmitters Improper Access Control

The application suffers from improper access control when editing users. A user with read permissions can manipulate users, passwords, and permissions by sending a single HTTP POST request with modified parameters...

OpenRapid RapidCMS 授权问题漏洞

OpenRapid RapidCMS is OpenRapid open source a fast and simple to use CMS system. An authorization issue vulnerability exists in OpenRapid RapidCMS version 1.3.1, which stems from the fact that incorrect manipulation of the parameters password/password2 can lead to weak password recovery...

CVE-2023-31432

Through manipulation of passwords or other variables, using commands such as portcfgupload, configupload, license, myid, a non-privileged user could obtain root privileges in Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c and v9.2.0...

CVE-2023-34108

mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration. A vulnerability has been discovered in mailcow which allows an attacker to manipulate internal Dovecot variables by using specially crafted...

CVE-2023-2790

The CVE-2023-2790 entry describes a local vulnerability in TOTOLINK N200RE 9.3.5u.6255_B20211224: the Telnet Service’s file /squashfs-root/etc_ro/custom.conf contains an unknown function with improper protection, allowing manipulation that exposes passwords in the configuration file. The issue is...

PT-2023-10234 · Unknown · Picturethiswebserver

Name of the Vulnerable Software and Affected Versions: PictureThisWebServer affected versions not specified Description: A critical issue affects the function router.post of the file routes/user.js. The manipulation of the arguments username and password leads to sql injection. Recommendations:...

PictureThisWebServer SQL注入漏洞

PictureThisWebServer is a web project. PictureThisWebServer suffers from a SQL injection vulnerability that stems from a security issue in the function router.post in the file routes/user.js, where manipulation of the parameter username/password leads to SQL injection...

CVE-2022-4228

A vulnerability classified as problematic has been found in SourceCodester Book Store Management System 1.0. This affects an unknown part of the file /bsmsci/index.php/user/edituser/. The manipulation of the argument password leads to information disclosure. It is possible to initiate the attack...

CVE-2022-4228 SourceCodester Book Store Management System information disclosure

A vulnerability classified as problematic has been found in SourceCodester Book Store Management System 1.0. This affects an unknown part of the file /bsmsci/index.php/user/edituser/. The manipulation of the argument password leads to information disclosure. It is possible to initiate the attack...

CVE-2022-4228 SourceCodester Book Store Management System information disclosure

A vulnerability classified as problematic has been found in SourceCodester Book Store Management System 1.0. This affects an unknown part of the file /bsmsci/index.php/user/edituser/. The manipulation of the argument password leads to information disclosure. It is possible to initiate the attack...

PT-2022-25149 · Unknown · Monikabrzica Scm

Name of the Vulnerable Software and Affected Versions: MonikaBrzica scm affected versions not specified Description: A critical issue has been found in MonikaBrzica scm, affecting some unknown functionality of the file upis u bazu.php. The manipulation of the email, lozinka, ime, or id arguments...

CVE-2022-2086

A vulnerability, which was classified as critical, has been found in SourceCodester Bank Management System 1.0. Affected by this issue is login.php. The manipulation of the argument password with the input 1'and 1=2 union select 1,sleep10,3,4,5 --+ leads to sql injection. The attack may be launch...

Account Takeover

Description Hi there i found that forget password functionality can be manipulated and this lead to account takeover. So even if an attacker can takeover low access user to admin accounts. In this bug server is vulnerable to php type juggling attack Proof of Concept 1. While registering app for...

CVE-2021-33723

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. An authenticated attacker could change the user profile of any user without proper authorization. With this, the attacker could change the password of any user in the affected system...

CVE-2020-27885

Cross-Site Scripting XSS vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged-in user’s session by stealing cookies which means that a malicious hacker can change the logged-in user’s password and invalidate the session of th...

Liman 0.7 - Cross-Site Request Forgery (Change Password)

Exploit Title: Liman 0.7 - Cross-Site Request Forgery Change Password Date: 2020-10-07 Exploit Author: George Tsimpidas Software Link : https://github.com/salihciftci/liman/releases/tag/v0.7 Version: 0.7 Tested on: Ubuntu 18.04.5 LTS Bionic Beaver Category: Webapp Description: There is no CSRF...

Dell EMC Integrated Data Protection Appliance Operating System Command Injection Vulnerability

Dell EMC Integrated Data Protection Appliance is a disk-based backup and recovery solution from Dell, Inc.ACM is one of the application configuration management components. An operating system command injection vulnerability exists in the ACM component of the Dell EMC Integrated Data Protection...

CVE-2020-5350

Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords...

CVE-2020-5350: Improper Neutralization of Special Elements used in an OS Command

Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords...

CVE-2020-5350

Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords...