96 matches found
CVE-2022-1287
A vulnerability classified as critical was found in School Club Application System 1.0. This vulnerability affects a request to the file /scas/classes/Users.php?f=saveuser. The manipulation with a POST request leads to privilege escalation. The attack can be initiated remotely and does not requir...
PT-2022-13776
Name of the Vulnerable Software and Affected Versions School Club Application System version 1.0 Description A critical issue was found in the system, affecting requests to the "/scas/classes/Users.php?f=save user" endpoint. The manipulation with a POST request leads to privilege escalation. The...
CVE-2020-19682
A Cross Site Request Forgery CSRF vulnerability exits in ZZZCMS V1.7.1 via the saveuser funciton in save.php...
PT-2021-10387
Name of the Vulnerable Software and Affected Versions: ZZZCMS version 1.7.1 Description: A Cross Site Request Forgery CSRF issue exists via the save user function in the "save.php" endpoint. This allows for unauthorized actions to be performed on behalf of a user. Recommendations: For ZZZCMS...
CVE-2021-40261
Multiple Cross Site Scripting XSS vulnerabilities exist in SourceCodester CASAP Automated Enrollment System 1.0 via the 1 userusername and 2 category parameters in saveclass.php, the 3 firstname, 4 class, and 5 status parameters in studenttable.php, the 6 category and 7 classname parameters in...
CVE-2021-26230
Cross-site scripting XSS vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the user information to saveuser.php...
Solarwinds Orion Platform security vulnerabilities
Solarwinds Orion Platform is a network fault and network performance management platform from Solarwinds, Inc. The platform provides real-time monitoring and analysis of network devices and supports a customizable web interface, multiple user opinions, and a mapped view of the entire network. An...
CVE-2021-27963
SonLogger before 6.4.1 is affected by user creation with any user permissions profile e.g., SuperAdmin. An anonymous user can send a POST request to /User/saveUser without any authentication or session header...
CVE-2020-2004
Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on GlobalProtect app also known as GlobalProtect Agent for MacOS and Windows. For this issue to occur all of these conditions must be true: 1 'Sav...
Microweber Cross-Site Request Forgery Vulnerability
Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site request forgery vulnerability exists in Microweber version 1.0.7. A remote...
PT-2018-13898
Name of the Vulnerable Software and Affected Versions Microweber version 1.0.7 Description An issue was discovered that allows a CSRF attack against the admin user, enabling the addition of an administrative account via the "api/save user" endpoint. Recommendations For Microweber version 1.0.7,...
SyndeoCMS Cross-Site Request Forgery Vulnerability
SyndeoCMS is a content management system for elementary schools. A cross-site request forgery vulnerability exists in SyndeoCMS 3.0 and prior versions that allows remote attackers to hijack the authentication of an administrator's request to add a user account, saveuser...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in OpenMRS 2.1 Standalone Edition allows remote attackers to hijack the authentication of administrators for requests that add a new user via a Save User action to admin/users/user.form...
PT-2014-8397
Name of the Vulnerable Software and Affected Versions OpenMRS version 2.1 Standalone Edition Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that add a new user via a Save User action to "admin/users/user.form...
