CVE-2023-38759

Cross Site Request Forgery CSRF vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/resetuserpassword.html, templates/user/overview.html, core/views/user.py, and...

PYSEC-2023-144

Cross Site Request Forgery CSRF vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/resetuserpassword.html, templates/user/overview.html, core/views/user.py, and...

PYSEC-2023-144

Cross Site Request Forgery CSRF vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/resetuserpassword.html, templates/user/overview.html, core/views/user.py, and...

CVE-2023-38759

Cross Site Request Forgery CSRF vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/resetuserpassword.html, templates/user/overview.html, core/views/user.py, and...

CVE-2023-38759

CVE-2023-38759 describes a Cross-Site Request Forgery (CSRF) vulnerability in the wger Project, Workout Manager version 2.2.0a3. The issue enables a remote attacker to gain privileges via the user-management features, affecting multiple components/files (e.g., gym.py, reset_user_password.html, ov...

CMSshop 1 Cross Site Scripting

==================================================================================================================================== | Title : CMSshopir v1 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 66.0.332-bit | | Vendor :...

CVE-2023-3987 SourceCodester Simple Online Mens Salon Management System sql injection

A vulnerability was found in SourceCodester Simple Online Mens Salon Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?page=user/manageuser&id=3. The manipulation of the argument id leads to sql injection. It is possible to launch the...

PT-2023-27139 · Unknown · Sourcecodester Simple Online Mens Salon Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Online Mens Salon Management System version 1.0 Description: A critical issue has been found, affecting an unknown function of the file "/admin/?page=user/manage user&id=3". The manipulation of the id argument leads to S...

ETSI WEBstore 2023 - Persistent Cross Site Vulnerability

Document Title: =============== ETSI WEBstore 2023 - Persistent Cross Site Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2327 Release Date: ============= 2023-07-25 Vulnerability Laboratory ID VL-ID: ====================================...

KubePi Privilege Escalation vulnerability

Summary A normal user has permission to create/update users, they can become admin by editing the isadmin value in the request PoC Change the value of the isadmin field in the request to true: https://drive.google.com/file/d/1e8XJbIFIDXaFiL-dqn0a0b6u7o3CwqSG/preview Impact Elevate user privileges...

KubePi 安全漏洞

KubePi is a K8s panel. It allows administrators to import multiple Kubernetes clusters and assign permissions for different clusters, namespaces to specified users through permission control. A security vulnerability exists in KubePi versions prior to 1.6.5, which stems from the fact that normal...

WordPress WordPress User Management and User Admin Plugin – User Magic Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)

Software WordPress User Management and User Admin Plugin – User Magic Type Plugin Vulnerable versions = 1.0.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5dac84f1c8...

CVE-2023-3659 SourceCodester AC Repair and Services System cross site scripting

A vulnerability has been found in SourceCodester AC Repair and Services System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/?page=user/manageuser. The manipulation of the argument firstname/middlename leads to cross site scripting...

AC Repair and Services System 跨站脚本漏洞

AC Repair and Services System is an air conditioning repair and services system by the individual developer Carlo Montero. A cross-site scripting vulnerability exists in SourceCodester AC Repair and Services System version 1.0, which stems from the parameter firstname/middlename in the file...

CVE-2023-27225

A cross-site scripting XSS vulnerability in User Registration & Login and User Management System with Admin Panel v3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the first and last name field...

CVE-2023-27225

A cross-site scripting XSS vulnerability in User Registration & Login and User Management System with Admin Panel v3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the first and last name field...

Cross site scripting

A cross-site scripting XSS vulnerability in User Registration & Login and User Management System with Admin Panel v3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the first and last name field...

CVE-2023-27225

A cross-site scripting XSS vulnerability in User Registration & Login and User Management System with Admin Panel v3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the first and last name field...

CVE-2023-27225

CVE-2023-27225 affects User Registration & Login and User Management System with Admin Panel v3. The vulnerability is a cross-site scripting (XSS) flaw in the first-name and last-name input fields, allowing attackers to inject arbitrary web scripts/HTML. Documented impact is client-side code exec...

CSV Injection while export users

1 admin add a user, or a user signup. 2 the user logins and edit himeself 3 the user change his realname as "=1+cmd|'/C calc'!A0" 4 admin go to export the users as a csv file 5 admin open the csv and we can see that the calculator is opened. see https://owasp.org/www-community/attacks/CSVInjectio...