133 matches found
HTML Injection
Overview com.xuxueli:xxl-job is a distributed task scheduling framework. Affected versions of this package are vulnerable to HTML Injection. HTML uploaded payload executed successfully through /xxl-job-admin/user/add and /xxl-job-admin/user/update. Details Cross-site scripting or XSS is a code...
CVE-2022-38358
Improper neutralization of input during web page generation leaves the Eyes of Network web application vulnerable to cross-site scripting attacks at /module/adminnotifiers/rules.php and /module/reportevent/indext.php via the parameters rulenotification, rulename, and rulenameold, and at...
CVE-2019-25070 WolfCMS User Add cross site scripting
UNSUPPORTED WHEN ASSIGNED A vulnerability was found in WolfCMS up to 0.8.3.1. It has been rated as problematic. This issue affects some unknown processing of the file /wolfcms/?/admin/user/add of the component User Add. The manipulation of the argument name leads to basic cross site scripting. Th...
CVE-2019-25070
CVE-2019-25070 affects WolfCMS up to version 0.8.3.1 in the User Add path (/wolfcms/?/admin/user/add). The vulnerability arises from improper handling of the name parameter, enabling basic cross-site scripting (XSS). Exploitation can be remote and public disclosures exist. Several connected sourc...
GHSA-79M2-H67V-35Q7 Elefant CMS CSRF Vulnerability
An issue was discovered in Elefant CMS before 2.0.5. There is a CSRF vulnerability that can add an account via user/add...
Elefant CMS CSRF Vulnerability
An issue was discovered in Elefant CMS before 2.0.5. There is a CSRF vulnerability that can add an account via user/add...
OPMS 跨站请求伪造漏洞
OPMS is an OA management system. v1.3 and previous versions of OPMS contain a security vulnerability that can be exploited to add arbitrary user accounts via /user/add...
CVE-2019-18223
ZOOM International Call Recording 6.3.1 suffers from multiple authenticated stored XSS vulnerabilities via the phoneNumber field in the 1 User Edit or 2 User Add form, 3 name field in the Role Add form, 4 name or number field in the Edit Group form, 5 tagKey or tagValue field in the Recording Rul...
CVE-2019-18223
ZOOM International Call Recording 6.3.1 suffers from multiple authenticated stored XSS vulnerabilities via the phoneNumber field in the 1 User Edit or 2 User Add form, 3 name field in the Role Add form, 4 name or number field in the Edit Group form, 5 tagKey or tagValue field in the Recording Rul...
Cross site scripting
ZOOM International Call Recording 6.3.1 suffers from multiple authenticated stored XSS vulnerabilities via the phoneNumber field in the 1 User Edit or 2 User Add form, 3 name field in the Role Add form, 4 name or number field in the Edit Group form, 5 tagKey or tagValue field in the Recording Rul...
CVE-2019-18223
ZOOM International Call Recording 6.3.1 suffers from multiple authenticated stored XSS vulnerabilities via the phoneNumber field in the 1 User Edit or 2 User Add form, 3 name field in the Role Add form, 4 name or number field in the Edit Group form, 5 tagKey or tagValue field in the Recording Rul...
CVE-2019-18223
The CVE-2019-18223 entry concerns Zoom Call Recording (version 6.3.1) and describes authenticated stored XSS vulnerabilities. Multiple input vectors are identified, including: (1) phoneNumber in User Edit/Add forms, (2) name in Role Add form, (3) name or number in Edit Group, (4) tagKey/tagValue ...
VMware vCenter Server vmdir Authentication Bypass
This module bypasses LDAP authentication in VMware vCenter Server's vmdir service to add an arbitrary administrator user. Version 6.7 prior to the 6.7U3f update is vulnerable, only if upgraded from a previous release line, such as 6.0 or 6.5. Note that it is also possible to provide a bind userna...
Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password) Vulnerability
Exploit for php platform in category web applications Exploit Title: Adive Framework 2.0.8 - Cross-Site Request Forgery Change Admin Password Exploit Author: Sarthak Saini Vendor Link : https://www.adive.es/ Software Link: https://github.com/ferdinandmartin/adive-php7 Version: 2.0.8...
Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password)
Adive Framework 2.0.8 - Cross-Site Request Forgery Change Admin Password Exploit Title: Adive Framework 2.0.8 - Cross-Site Request Forgery Change Admin Password Exploit Author: Sarthak Saini Date: 2020-01-18 Vendor Link : https://www.adive.es/ Software Link:...
CVE-2020-7989
Adive Framework 2.0.8 has admin/user/add userUsername XSS...
CVE-2020-7990
Adive Framework 2.0.8 has admin/user/add userName XSS...
CVE-2020-7990
Adive Framework 2.0.8 has admin/user/add userName XSS...