Design/Logic Flaw

JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0, the default email for initial user admin is [email protected], and users reset their passwords by sending an email. Currently, the domain mycompany.com h...

PT-2023-29262 · Unknown · Online Blood Donation Management System

Name of the Vulnerable Software and Affected Versions: Online Blood Donation Management System version 1.0 Description: The issue concerns multiple Store Cross-Site Scripting vulnerabilities. The lastName parameter of the users/register.php endpoint is vulnerable. Recommendations: For Online Bloo...

CVE-2023-4393

HTML and SMTP injections on the registration page of LiquidFiles versions 3.7.13 and below, allow an attacker to perform more advanced phishing attacks against an organization...

PT-2023-8572 · N Able · N-Able Passportal Extension

Name of the Vulnerable Software and Affected Versions: N-able PassPortal extension versions prior to 3.29.2 for Chrome Description: The issue is related to insufficient protection of registration data, which may allow an attacker to gain unauthorized access to protected information. The N-able...

CVE-2023-4393

CVE-2023-4393 affects LiquidFiles (registration page) with HTML and SMTP injections in version 3.7.13 and earlier. Root cause described as input/registration-page injection flaws enable more advanced phishing attacks against organizations. Red Hat and other feeds corroborate the same description....

PT-2023-29043 · Unknown · Liquidfiles

Name of the Vulnerable Software and Affected Versions: LiquidFiles versions 3.7.13 and below Description: The issue allows an attacker to perform more advanced phishing attacks against an organization through HTML and SMTP injections on the registration page. Recommendations: For versions 3.7.13...

CVE-2023-46467

Cross Site Scripting vulnerability in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter of the registration page...

Cross site scripting

Cross Site Scripting vulnerability in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter of the registration page...

Juzaweb CMS Cross-Site Scripting Vulnerability

Juzaweb CMS is a content management system developed by Juzaweb individual developers based on the Laravel framework and Web platform. A cross-site scripting vulnerability exists in Juzaweb CMS v.3.4 and earlier versions that could allow a remote attacker to execute arbitrary code by injecting a...

CVE-2023-46467

Cross Site Scripting vulnerability in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter of the registration page...

CVE-2023-46467

Cross Site Scripting vulnerability in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter of the registration page...

CVE-2023-46467

Cross Site Scripting vulnerability in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter of the registration page...

The vulnerability of the common/info.cgi component in D-Link DCS series Wi-Fi cameras allows a intruder to disclose protected information.

The vulnerability of the common/info.cgi component in D-Link DCS Wi-Fi camera software lies in the insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...

PT-2023-30036 · Unknown · Juzawebcms

Name of the Vulnerable Software and Affected Versions: juzawebCMS versions 3.4 and earlier Description: The issue allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter of the registration page. This is a Cross Site Scripting vulnerability...

How to re-register device profile on Citrix Cloud ADM for the Citrix cloud hosted Netscalers

How to re-register device profile on Citrix Cloud ADM for the Citrix cloud hosted Netscalers...

CVE-2023-46202

Cross-Site Request Forgery CSRF vulnerability in Jeff Sherk Auto Login New User After Registration plugin = 1.9.6 versions...

CVE-2023-46202

Cross-Site Request Forgery CSRF vulnerability in Jeff Sherk Auto Login New User After Registration plugin = 1.9.6 versions...

Authentication flaw

PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this vulnerability to register their own MFA device if they have knowledge of a victim user's...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Jeff Sherk Auto Login New User After Registration plugin = 1.9.6 versions...

WordPress Plugin Auto Login New User After Registration Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists i...