PT-2023-21053 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 7.2-64561 Description: The issue concerns the use of insufficiently random values in the User Management Functionality, allowing remote attackers to obtain user credentials via unspecified...

CVE-2023-3176

A vulnerability, which was classified as critical, was found in SourceCodester Lost and Found Information System 1.0. Affected is an unknown function of the file admin\user\manageuser.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. Th...

PT-2023-23453 · Sourcecodester · Sourcecodester Lost/Found Information System

Name of the Vulnerable Software and Affected Versions: SourceCodester Lost and Found Information System version 1.0 Description: A critical issue was found in the SourceCodester Lost and Found Information System. The problem affects an unknown function of the file adminusermanage user.php. The...

Lost and Found Information System SQL注入漏洞

Lost and Found Information System is a lost and found information system by oretnom23 individual developer. A SQL injection vulnerability exists in Lost and Found Information System version 1.0, which stems from a problem in the file adminusermanageuser.php, where incorrect manipulation of the...

Stored XSS vulnerability

Description The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Proof of Concept 1 Step1: The user has the right to access and perform the creation of surveys, with the payload...

Sql injection

A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file user\manageuser.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The...

PT-2023-23362 · Unknown · Sourcecodester Online Discussion Forum Site

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Discussion Forum Site version 1.0 Description: A critical issue has been discovered, allowing for SQL injection through the manipulation of the id argument in an unknown function of the file adminusermanage user.php. Thi...

Create multiple user with the same username (Race Condition)

Description Administrator users can create multiple users with the same username which breaks the logic of the web application. Proof of Concept Step 1: At AdministrationUser ManagementManager User Screen, click on "New Local User" button Step 2: Fill in all the required fields, notice that the...

Authorization

SGUDA U-Lock central lock control service’s user management function has incorrect authorization. A remote attacker with general user privilege can exploit this vulnerability to call privileged APIs to access, modify and delete user information...

SGUDA U-Lock 安全漏洞

SGUDA U-Lock is a smart electronic lock from SGUDA. A security vulnerability exists in SGUDA U-Lock, which stems from an authorization error in the user management function of the central locking service. The vulnerability can be exploited by a remote attacker to invoke a privileged API to access...

CVE-2022-46308

The CVE-2022-46308 issue affects the SGUDA U-Lock central lock control service’s user management function, described as an incorrect authorization (broken access control). An attacker with general (low-privilege) user rights can call privileged APIs to access, modify, or delete user information, ...

PT-2023-14905 · Sguda · Sguda U-Lock

Name of the Vulnerable Software and Affected Versions: SGUDA U-Lock central lock control service affected versions not specified Description: The issue is related to incorrect authorization in the user management function of the SGUDA U-Lock central lock control service. A remote attacker with...

Stored XSS in End page

Description Allows a user who only has the authority to create surveys not the administrator to bypass validation and embed javascript schemes when creating surveys Step to reproduce - Login as administrator 1. Open User management and Create a user with create surveys only permissions. 1. Logout...

Wordpress plugin User Meta – User Profile Builder and User management 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

U.S. Dept Of Defense: Automatic Admin Access

The automatic administrative access vulnerability allowed a user to access the application with full administrative privileges, including the ability to create submissions, manage users, and access sensitive data. The vulnerability impacted the integrity, confidentiality, and availability of the...

PT-2023-20772 · Unknown · Sourcecodester Lost/Found Information System

Name of the Vulnerable Software and Affected Versions: SourceCodester Lost and Found Information System version 1.0 Description: A critical issue has been found, affecting the file "admin/?page=user/manage user". This leads to improper access controls, and the attack can be initiated remotely. Th...

The vulnerability of the Proxy User Delegation sub-component of the Oracle User Management component in the Oracle E-Business Suite system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Proxy User Delegation sub-component of the Oracle User Management component in the Oracle E-Business Suite automation system for enterprise activities is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker operating remote...

CVE-2022-46308

SGUDA U-Lock central lock control service’s user management function has incorrect authorization. A remote attacker with general user privilege can exploit this vulnerability to call privileged APIs to access, modify and delete user information...

privilege escalation with least config

Description User can privilege escalation to admin role which least config Proof of Concept login in https://11.x-dev.pimcore.fun/admin/ and add a new users in settings - users with have access Permissions - users after that login in a new user and come settings - users - new user update new rule...

PT-2023-20817 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 4.5.3 Description: A cross-site request forgery CSRF vulnerability allows attackers to change any user's password except for the user that is currently logged in. Recommendations: For ChurchCRM version 4.5.3, consider...