528 matches found
CVE-2009-5025
A backdoor aka BMSA-2009-07 was found in PyForum v1.0.3 where an attacker who knows a valid user email could force a password reset on behalf of that user...
The vulnerability in the server management application CentOS Web Panel arises due to insufficient validation of input data. This allows a malicious individual to delete a user’s email account.
The vulnerability of the CentOS Web Panel server management application exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to delete the user’s email account remotely...
The vulnerability of the server management application CentOS Web Panel arises due to insufficient validation of input data. This allows a hacker to change the email password of the user account.
The vulnerability of the CentOS Web Panel server management application exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to remotely change the user’s email account password...
Cross-Site Scripting (XSS)
moodle/moodle is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a user's browser via the user's email, causing the payload to be rendered and executed on pages that displays the malicious email address...
CVE-2014-5516
Cross-site request forgery CSRF vulnerability in the Storefront Application in DS Data Systems KonaKart before 7.3.0.0 allows remote attackers to hijack the authentication of administrators for requests that change a user email address via an unspecified GET request...
CVE-2014-5516
Cross-site request forgery CSRF vulnerability in the Storefront Application in DS Data Systems KonaKart before 7.3.0.0 allows remote attackers to hijack the authentication of administrators for requests that change a user email address via an unspecified GET request...
CVE-2014-5516
KonaKart Storefront Application (DS Data Systems) prior to 7.3.0.0 is vulnerable to CSRF protection bypass that allows an attacker to hijack an administrator’s session by issuing a manipulated GET request to change a user email address. The issue is documented in CVE-2014-5516, with a remediation...
CVE-2014-5516: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in the Storefront Application in DS Data Systems KonaKart before 7.3.0.0 allows remote attackers to hijack the authentication of administrators for requests that change a user email address via an unspecified GET request...
Wordpress Ultimate Addons for Beaver Builder 1.2.4.1 - Authentication Bypass Exploit
Exploit for php platform in category web applications Exploit Title: Wordpress Ultimate Addons for Beaver Builder 1.2.4.1 - Authentication Bypass Exploit Authors: Raphael Karger & Nathan Hrncirik Vendor Homepage: https://www.ultimatebeaver.com/ Version: Ultimate Addons for Beaver Builder | || |...
WordPress Plugin Ultimate Addons for Beaver Builder 1.2.4.1 - Authentication Bypass
Exploit Title: Wordpress Ultimate Addons for Beaver Builder 1.2.4.1 - Authentication Bypass Date: 2019-12-21 Exploit Authors: Raphael Karger & Nathan Hrncirik Vendor Homepage: https://www.ultimatebeaver.com/ Version: Ultimate Addons for Beaver Builder | || | |/| / /| / //\ | /|//|||| / / / /...
WordPress ThemeMakers Car Dealer / Auto Dealer Responsive theme Information Disclosure Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.ThemeMakers Car Dealer / Auto Dealer Responsive theme is one of the car sales website theme plugins used in it. WordPress...
WordPress ThemeMakers Accio Responsive Parallax One Page Site Template Information Disclosure Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.ThemeMakers Accio Responsive Parallax One Page Site Template is a responsive one page parallax effect website theme plugin...
WordPress ThemeMakers Diplomat|Political theme information leakage vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.ThemeMakers Diplomat|Political theme is a theme plugin for diplomatic and political websites. WordPress ThemeMakers Diplomat|Political...
WordPress ThemeMakers Invento Responsive Gallery/Architecture Template Information Disclosure Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.ThemeMakers Invento Responsive Gallery/Architecture Template is a responsive gallery plugin used in... WordPress ThemeMakers Invento...
WordPress ThemeMakers Axioma Premium Responsive theme Information Disclosure Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.ThemeMakers Axioma Premium Responsive theme is a responsive website theme plugin used in it. WordPress ThemeMakers Axioma...
WordPress ThemeMakers Almera Responsive Portfolio theme Information Disclosure Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.ThemeMakers Almera Responsive Portfolio theme is one of the responsive website theme plugins used in it. WordPress ThemeMake...
WordPress ThemeMakers Almera Responsive Portfolio Site Template Information Disclosure Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.ThemeMakers Almera Responsive Portfolio Site Template is one of the responsive website theme plugins used in it. WordPress...
Command injection
User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens...
