1049 matches found
CVE-2022-21684 User can bypass approval when invited to Discourse
Discourse is an open source discussion platform. Versions prior to 2.7.13 in stable, 2.8.0.beta11 in beta, and 2.8.0.beta11 in tests-passed allow some users to log in to a community before they should be able to do so. A user invited via email to a forum with mustapproveusers enabled is going to ...
CVE-2021-45379
Glewlwyd 2.0.0, fixed in 2.6.1 is affected by an incorrect access control vulnerability. One user can attempt to log in as another user without its password...
CVE-2021-45379
Glewlwyd 2.0.0, fixed in 2.6.1 is affected by an incorrect access control vulnerability. One user can attempt to log in as another user without its password...
CVE-2020-21237
An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks...
CVE-2020-21238
An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks...
Design/Logic Flaw
An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks...
Design/Logic Flaw
An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks...
CVE-2020-21238
CVE-2020-21238 affects CSCMS v4.0, with a weakness in the user login box that enables brute-force attacks to hijack user accounts. The issue is documented across multiple sources (NVD entry notes brute-force risk; Red Hat and CNVD mirror the same description). Exploitation status and exact exploi...
CVE-2020-21238
An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks...
CVE-2020-21237
CVE-2020-21237 affects LJCMS v1.11 and is due to a login-box vulnerability that allows brute-force attempts to hijack user accounts. The available documents explicitly describe a lack of effective protection against brute-force login, enabling account hijacking. No concrete patch details, affecte...
CVE-2020-21237
An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks...
phpKF CMS 3.00 Beta y6 - Remote Code Execution (Unauthenticated) Exploit
Exploit Title: phpKF CMS 3.00 Beta y6 - Remote Code Execution RCE Unauthenticated Exploit Author: Halit AKAYDIN hLtAkydn Vendor Homepage: https://www.phpkf.com/ Software Link: https://www.phpkf.com/indirme.php Version: 3.00 Category: Webapps Tested on: Linux/Windows phpKF-CMS; It is a very popula...
CVE-2021-31632
b2evolution CMS v7.2.3 was discovered to contain a SQL injection vulnerability via the parameter cfqueryparam in the User login section. This vulnerability allows attackers to execute arbitrary code via a crafted input...
CVE-2021-31631
b2evolution CMS v7.2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the User login page. This vulnerability allows attackers to escalate privileges...
CVE-2021-31631
b2evolution CMS v7.2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the User login page. This vulnerability allows attackers to escalate privileges...
CVE-2021-31632
b2evolution CMS v7.2.3 was discovered to contain a SQL injection vulnerability via the parameter cfqueryparam in the User login section. This vulnerability allows attackers to execute arbitrary code via a crafted input...
Sql injection
b2evolution CMS v7.2.3 was discovered to contain a SQL injection vulnerability via the parameter cfqueryparam in the User login section. This vulnerability allows attackers to execute arbitrary code via a crafted input...
Cross site request forgery (csrf)
b2evolution CMS v7.2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the User login page. This vulnerability allows attackers to escalate privileges...
CVE-2021-31632
b2evolution CMS v7.2.3 was discovered to contain a SQL injection vulnerability via the parameter cfqueryparam in the User login section. This vulnerability allows attackers to execute arbitrary code via a crafted input...
CVE-2021-31632
Affected software: b2evolution CMS v7.2.3. Vulnerability: SQL injection via the cfqueryparam parameter in the User login section. Root cause / nature: input crafting leads to injection and potential arbitrary code execution. Impact: high (per CVSS measures) with potential code execution; exact ex...