226 matches found
CVE-2020-36918
CVE-2020-36918 affects the iDS6 DSSPro Digital Signage System v6.2. It describes a cross-site request forgery (CSRF) where an attacker can induce susceptible admins to perform actions (e.g., add unauthorized users) without proper request validation by crafting malicious pages. The vulnerability s...
CVE-2018-25149
CVE-2018-25149 affects Microhard Systems IPn4G 1.1.0. The vulnerability is a cross-site request forgery (CSRF) in the device’s web interface that allows an attacker to induce administrative actions without user consent by tricking an authenticated user into loading a malicious page. Documented im...
PT-2025-53369
Microhard Systems IPn4G 1.1.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change admin passwords, add new users, and modify system settings by tricking authenticated...
EUVD-2025-199650
An issue was discovered in jishenghua JSHERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks...
CVE-2025-51744
An issue was discovered in jishenghua JSHERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks...
Magewell Ultra Encode 安全漏洞
Magewell Ultra Encode is a video encoder from the Chinese company Magewell. A security vulnerability exists in Magewell Ultra Encode version 1.2.213, which originates from a cross-site request forgery in the /usapi?method=add-user component...
CVE-2025-55127
HackerOne community member Dao Hoang Anh yoyomiski has reported an improper neutralization of whitespace in the username when adding new users. A username with leading or trailing whitespace could be virtually indistinguishable from its legitimate counterpart when the username is displayed in the...
PT-2025-46685
Name of the Vulnerable Software and Affected Versions xxl-api version 1.3.0 Description A Cross-Site Request Forgery CSRF exists in xxl-api version 1.3.0. This allows attackers to add users to the management module by sending a specially crafted GET request. The attack leverages a lack of proper...
CVE-2025-60645
A Cross-Site Request Forgery CSRF in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request...
CVE-2025-60645
A Cross-Site Request Forgery CSRF in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request...
CVE-2025-56008
Cross site scripting XSS vulnerability in KeeneticOS before 4.3 at "Wireless ISP" page allows attackers located near to the router to takeover the device via adding additional users with full permissions...
CVE-2025-56007
The KeeneticOS operating system, developed by Keenetic, is vulnerable to a CRLF-injection flaw in versions prior to 4.3 . The vulnerability exists at the /auth API endpoint due to a failure to properly neutralize CRLF sequences. A remote attacker can exploit this by tricking a victim into opening...
EUVD-2018-4561
Malware in sbrugna...
EUVD-2020-11175
Malware in sbrugna...
EUVD-2010-5256
Malware in sbrugna...
EUVD-2018-7080
Malware in sbrugna...
EUVD-2018-7076
Malware in sbrugna...
EUVD-2018-11030
Malware in sbrugna...