226 matches found
CVE-2020-9341
CandidATS 2.1.0 is vulnerable to CSRF that allows for an administrator account to be added via the index.php?m=settings=addUser URI...
CVE-2020-9018
LiteCart through 2.2.1 allows admin/?app=users=edituser CSRF to add a user...
CVE-2020-8504
School Management Software PHP/mySQL through 2019-03-14 allows officeadmin/?action=addadmin CSRF to add an administrative user...
CVE-2020-23837
A Cross-Site Request Forgery CSRF vulnerability in the Multi User plugin 1.8.2 for GetSimple CMS allows remote attackers to add admin or other users after an authenticated admin visits a third-party site or clicks on a URL...
CVE-2020-21358
A cross site request forgery CSRF in Wage-CMS 1.5.x-dev allows attackers to arbitrarily add users...
CVE-2020-19264
A cross-site request forgery CSRF in MipCMS v5.0.1 allows attackers to arbitrarily add users via index.php?s=/user/ApiAdminUser/itemAdd...
CVE-2011-2773
Cross-site request forgery CSRF vulnerability in Mahara before 1.4.1 allows remote attackers to hijack the authentication of administrators for requests that add a user to an institution...
CVE-2019-10237
S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin=add⟨=0 URI, a related issue to CVE-2019-9040...
CVE-2019-4091
"HCL Marketing Platform is vulnerable to cross-site scripting during addition of new users and also while searching for users in Dashboard, potentially giving an attacker ability to inject malicious code into the system. "...
CVE-2018-15198
An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user...
CVE-2019-19832
Xerox AltaLink C8035 printers allow CSRF. A request to add users is made in the Device User Database form field to the xerox.set URI. The frmUserName value must have a unique name...
GHSA-R7R2-M3VR-C8QC Mattermost Fails to Validate Team Invite Permissions
Mattermost versions 10.6.x = 10.6.1, 10.5.x = 10.5.2, 10.4.x = 10.4.4, 9.11.x = 9.11.11 fail to check the correct permissions which allows authenticated users who only have permission to invite non-guest users to a team to add guest users to that team via the API to add a single user to a team...
CVE-2025-46547
CVE-2025-46547 : In Sherpa Orchestrator 141851, the web application lacks CSRF protection, enabling an attacker to perform actions such as XSS, adding a new user or role, or triggering SQL injection. The issue is documented across multiple sources (NVD/Red Hat/CIRCL/CVE list) with similar descrip...
PT-2025-16228
Name of the Vulnerable Software and Affected Versions: SoftCOM iKSORIS Internet Starter versions prior to 79.0 Description: The issue is related to Reflected XSS Cross-site Scripting attacks. An attacker might trick a user into filling a form designed for adding users with a malicious script, whi...
CVE-2024-56325
Versions of Apache Pinot prior to 1.3.0 are vulnerable to an authentication bypass (CWE-288). The flaw exists within the AuthenticationFilter class due to insufficient neutralization of special characters in URIs. Specifically, if a request path lacks a forward slash (/) and contains a period (.)...
HMS EWON FLEXY 202 安全漏洞
HMS EWON FLEXY 202 is a multi-purpose IIoT data gateway from HMS Sweden. Allows machine builders and users to monitor and collect important KPIs for analysis and predictive maintenance. A security vulnerability exists in the HMS EWON FLEXY 202 that stems from transmitting user credentials in...
The vulnerability of the cgi_user_add function in the CGI script /cgi-bin/account_mgr.cgi?cmd=cgi_user_add allows a hacker to execute arbitrary commands. This vulnerability affects microprogrammed devices from the D-Link series: DNS-320, DNS-320LW, DNS-325, and DNS-340L.
The vulnerability of the cgiuseradd function in the CGI script /cgi-bin/accountmgr.cgi?cmd=cgiuseradd in D-Link DNS-320, DNS-320LW, DNS-325, and DNS-340L devices is related to the failure to take measures to neutralize special elements used in the operating system command. Exploiting this...
CVE-2024-8350
The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgmmanagement/v1/adduser/ REST API endpoint in all versions up to, and including, 6.1.0.1. This makes it possible for authenticated attackers, with group...
PT-2024-38965 · WordPress · Uncanny Groups For Learndash
Name of the Vulnerable Software and Affected Versions: Uncanny Groups for LearnDash plugin for WordPress versions up to, and including, 6.1.0.1 Description: The issue allows authenticated attackers with group leader-level access and above to exploit a missing capability check on the "/wp-json/ulg...
