52 matches found
CVE-2025-46744 Improper Privilege Management
An authenticated administrator could modify the Created By username for a user account...
PT-2025-20716 · Schweitzer Engineering Laboratories · Sel Blueframe Os
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: An authenticated administrator could modify the Created By username for a user account. Recommendations: At the moment, there is no information about a newer version that contains a fix for...
CVE-2025-25948
Incorrect access control in the component /rest/staffResource/create of Serosoft Solutions Pvt Ltd Academia Student Information System SIS EagleR v1.0.118 allows create and modify user accounts, including an Administrator account...
CVE-2025-25950
Incorrect access control in the component /rest/staffResource/update of Serosoft Solutions Pvt Ltd Academia Student Information System SIS EagleR v1.0.118 allows create and modify user accounts, including an Administrator account...
CVE-2025-25950
Incorrect access control in the component /rest/staffResource/update of Serosoft Solutions Pvt Ltd Academia Student Information System SIS EagleR v1.0.118 allows create and modify user accounts, including an Administrator account...
CVE-2025-27583
Incorrect access control in the component /rest/staffResource/findAllUsersAcrossOrg of Serosoft Solutions Pvt Ltd Academia Student Information System SIS EagleR v1.0.118 allows create and modify user accounts, including an Administrator account...
CVE-2025-26523
CVE-2025-26523 affects the RupeeWeb trading platform. The vulnerability arises from insufficient authorization controls on certain API endpoints that perform add and delete operations, enabling an authenticated remote attacker to modify information belonging to other user accounts. Documented imp...
PT-2024-5860 · Glpi +2 · Glpi +2
Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.16 Description: The issue is related to a SQL injection vulnerability in some AJAX scripts of the GLPI software. This vulnerability can be exploited by an authenticated user to alter another user's account data and...
CVE-2024-36691
Insecure permissions in the AdminController.AjaxSave method of PPGoJobs v2.8.0 allows authenticated attackers to arbitrarily modify users' account information...
CVE-2021-39394
mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily add user accounts and modify user information...
Apache Archiva does not require entry of the administrator's password at the time of modifying a user account
Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a 1 unattended...
GHSA-5P54-JJ38-3HXJ Apache Archiva does not require entry of the administrator's password at the time of modifying a user account
Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a 1 unattended...
CVE-2020-6776
A vulnerability in the web-based management interface of Bosch PRAESIDEO until and including version 4.41 and Bosch PRAESENSA until and including version 1.10 allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user Cross-Site Request Forgery...
CVE-2018-19392
Cobham Satcom Sailor 250 and 500 devices before 1.25 contained an unauthenticated password reset vulnerability. This could allow modification of any user account's password including the default "admin" account, without prior knowledge of their password. All that is required is knowledge of the...
Cross site request forgery (csrf)
BageCMS 3.1.3 has CSRF via upload/index.php?r=admini/admin/ownerUpdate to modify a user account...
CVE-2018-19560
BageCMS 3.1.3 has CSRF via upload/index.php?r=admini/admin/ownerUpdate to modify a user account...
BageCMS Cross-Site Request Forgery Vulnerability (CNVD-2019-00135)
BageCMS is a cross-platform content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in BageCMS version 3.1.3. A remote attacker can exploit this vulnerability to modify user accounts with the help of the upload/index.php?r=admini/admin/ownerUpdate U...
NUUO NVRmini2 and NVRsolo
1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit/public exploits are available Vendor: NUUO Equipment: NVRmini2, NVRsolo Vulnerabilities: Stack-based Buffer Overflow, Leftover Debug Code 2. RISK EVALUATION Successful exploitation of these...