CVE-2022-22296

Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure Permissions via the id parameter in manageuser endpoint. Simply change the value and data of other users can be displayed...

CVE-2020-20595

A cross-site request forgery CSRF in OPMS v1.3 and below allows attackers to arbitrarily add a user account via /user/add...

CVE-2021-35491

A Cross-Site Request Forgery CSRF vulnerability in Wowza Streaming Engine through 4.8.11+5 allows a remote attacker to delete a user account via the /enginemanager/server/user/delete.htm userName parameter. The application does not implement a CSRF token for the GET request. This issue was resolv...

Wowza Media Systems Wowza Streaming Engine 跨站请求伪造漏洞

Wowza Media Systems Wowza Streaming Engine is a powerful, customizable and scalable media server software from Wowza Media Systems, USA. It is used to reliably stream high-quality video and audio to any device, anywhere. A cross-site request forgery vulnerability exists in Wowza Streaming Engine...

Autumn 安全漏洞

Autumn is a collection of Web subsystems designed to provide general purpose Web system solutions. A security vulnerability exists in Autumn v1.0.4 and earlier versions that stems from incorrect access control. The vulnerability allows remote attackers to obtain plaintext login credentials via th...

Eigen NLP 安全漏洞

Eigen NLP is a natural language processing system. A security vulnerability exists in Eigen NLP 3.10.1 that stems from the lack of access control on the /auth/v1/user/user-guid/ user edition endpoint. The vulnerability could allow any logged-in user to increase their own permissions via the...

CVE-2021-27731

Accellion FTA 912432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. The fixed version is FTA912444 and later...

Accellion FTA 跨站脚本漏洞

Accellion FTA is an enterprise content firewall from Accellion USA, Inc. provides a protection against data leaks and breaches from third-party network risks. A cross-site scripting vulnerability exists in Accellion FTA 912432 and earlier, which stems from a stored XSS via a POST request to the...

PT-2021-11960 · Unknown · Jupyterhub

Name of the Vulnerable Software and Affected Versions: JupyterHub version 1.1.0 Description: The issue allows for CSRF in the admin panel via a request that lacks an xsrf field. This can be demonstrated by a "/hub/api/user" request, which can be used to add or remove a user account...

CVE-2020-26878

Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API /service/v1/createUser endpoint, injecting arbitrary commands that will be executed as root user via web.py...

glpi -- able to read any token through API user endpoint

MITRE Corporation reports: In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All apitokens which can be used to do privileges escalations or...

CVE-2019-19990

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. Multiple Stored Cross-site scripting XSS vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via the web pages /monitor/sheadmodel.php and /vam/vamuser.php...

CVE-2018-19598

Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request...

Drobo 5N2 cross-site scripting vulnerability (CNVD-2019-05932)

The Drobo 5N2 NAS is a networked storage appliance NAS from Drobo, USA. The device features data sharing, data backup, remote access and disaster recovery. A cross-site scripting vulnerability exists in the /DroboAccess/deleteuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115. A remote...

Drobo 5N2 System Command Injection Vulnerability (CNVD-2019-05933)

The Drobo 5N2 NAS is a networked storage appliance NAS from Drobo, USA. The device features data sharing, data backup, remote access and disaster recovery. A command injection vulnerability exists in the /DroboAccess/enableuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115. An attacker can...

CVE-2018-14698

Cross-site scripting in the /DroboAccess/deleteuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the "username" URL parameter...

CVE-2018-14699

System command injection in the /DroboAccess/enableuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "username" URL parameter...

XYHCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-13984)

XYHCMS is an open source content management system CMS. A cross-site request forgery vulnerability exists in xyhai.php?s=/Auth/addUser URL in XYHCMS version 3.5. A remote attacker can exploit this vulnerability to add a backend administrator account...

PT-2018-2075 · D Link · D-Link Central Wifi Manager

Name of the Vulnerable Software and Affected Versions: D-Link Central WiFi Manager versions prior to 1.03r0100-Beta1 Description: An issue exists due to inadequate protection of the web page structure, allowing a remote attacker to inject arbitrary code into a loaded web page. The username...

DoorGets Cross-Site Request Forgery Vulnerability

doorGets is a content management system CMS. The system supports multiple languages, and system backups and theme changes, etc. A cross-site request forgery vulnerability exists in doorGets version 7.0 in dg-user/?controller=users&action=add. A remote attacker can exploit this vulnerability to ad...