CVE-2022-23227: Missing Authentication for Critical Function

NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handleimportuser.php authentication. When combined with another flaw CVE-2011-5325, it is possible to overwrite arbitrary files under...

CVE-2020-19264

A cross-site request forgery CSRF in MipCMS v5.0.1 allows attackers to arbitrarily add users via index.php?s=/user/ApiAdminUser/itemAdd...

CVE-2020-19264

A cross-site request forgery CSRF in MipCMS v5.0.1 allows attackers to arbitrarily add users via index.php?s=/user/ApiAdminUser/itemAdd...

CVE-2020-19264

MipCMS v5.0.1 has a cross-site request forgery (CSRF) vulnerability in the user-creation path index.php?s=/user/ApiAdminUser/itemAdd. The root cause is insufficient validation/CSRF protection, allowing an attacker to arbitrarily add users without authentication. The CVE-2020-19264 entry is refere...

Improper Privilege Management in microweber/microweber

✍️ Description A simple user without Super Admin access is able to add further users to the system. 🕵️‍♂️ Proof of Concept BurpSuite or proxy utility is required - 1;Simply add a simple User roled user USER A . - 2; Log in with USER A - 3; Obtain the X-Csrf-Token and the Cookie value of USER A - 4;...

MipCMS 跨站请求伪造漏洞

MipCMS is a software application. A set of content management system based on Baidu Mobile Accelerator MIP and development, but also a set of SEO site building system. MipCMS version 5.0.1 has a security vulnerability, the vulnerability stems from the lack of valid validation in the software...

Cross site request forgery (csrf)

A cross site request forgery CSRF in Wage-CMS 1.5.x-dev allows attackers to arbitrarily add users...

Wage-CMS 跨站请求伪造漏洞

Wage-CMS is a payroll system based on laravel-admin for small and medium-sized businesses. wage-CMS version 1.5.-dev is vulnerable to cross-site request forgery. An attacker can use this vulnerability to add arbitrary users...

CVE-2021-32718

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper tag sanitization, potentially allowing for JavaScript code execution in the...

Logic Flaw Vulnerability in 5MP Network Camera of Zhejiang YUV Technology Co.

Zhejiang YUVE Technology Co. Ltd. is a global provider of AIoT products, solutions and full-stack capabilities. A logic flaw vulnerability exists in the 5MP Network Camera of Zhejiang YUV Technology Co. Ltd, which can be exploited by an attacker to arbitrarily add users...

Cross site request forgery (csrf)

An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an admin user...

CVE-2021-28055

An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an admin user...

PT-2021-17732

Name of the Vulnerable Software and Affected Versions: Centreon Platform version 20.10.0 Description: An issue was discovered in Centreon-Web where the anti-CSRF token generation is predictable. This predictability might allow CSRF attacks, potentially enabling the addition of an admin user...

CVE-2021-28055: Use of Insufficiently Random Values

An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an admin user...

CVE-2020-23014

APfell 1.4 is vulnerable to authenticated reflected cross-site scripting XSS in /apiui/command through the payloadtypescallback function, which allows an attacker to steal remote admin/user session and/or adding new users to the administration panel...

CVE-2020-23014: Improper Neutralization of Input During Web Page Generation

APfell 1.4 is vulnerable to authenticated reflected cross-site scripting XSS in /apiui/command through the payloadtypescallback function, which allows an attacker to steal remote admin/user session and/or adding new users to the administration panel...

CVE-2020-25472

SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Request Forgery CSRF vulnerability, which allows attackers to add new users...

CVE-2020-25472

SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Request Forgery CSRF vulnerability, which allows attackers to add new users...

CVE-2020-25472

SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Request Forgery CSRF vulnerability, which allows attackers to add new users...

Simplephpscripts News Script PHP Pro 跨站请求伪造漏洞

News Script PHP Pro is a PHP/MySQL based web script from Simple PHP Scripts for displaying news on your website. A cross-site request forgery vulnerability exists in News Script PHP Pro 2.3. An attacker can exploit this vulnerability to add new users...