Design/Logic Flaw

BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks such as data backups to complete before a user is deleted...

CVE-2017-9378

BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks such as data backups to complete before a user is deleted...

CVE-2017-9378

BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks such as data backups to complete before a user is deleted...

CVE-2017-9378

BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks such as data backups to complete before a user is deleted...

CVE-2017-8099

There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request...

CVE-2017-8099

There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request...

WordPress WHIZZ Cross Site Request Forgery

Software: WordPress WHIZZ Version: active or disactive plugins: Mitigations ================ Disable the plugin until a new version is released that fixes this bug. FIX: ========== https://wordpress.org/plugins/whizz/ 1.1.1 changelog-Specifically Best regards, Zhiyang Zeng of Tencent security...

User Deletion Via Incorrect Permissions Check

keycloak-services is vulnerable to user deletion through an incorrect permissions check. A malicious user that has access to a service account can delete users in a seperate realm...

keycloak: user deletion via incorrect permissions check

It was found that keycloak did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm...

keycloak: user deletion via incorrect permissions check

It was found that keycloak did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm...

keycloak: user deletion via incorrect permissions check

It was found that keycloak did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm...

CVE-2016-8629

It was found that keycloak did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm...

CVE-2017-6914

CSRF exists in BigTree CMS 4.1.18 and 4.2.16 with the id parameter to the admin/ajax/users/delete/ page. A user can be deleted...

Delete Users from XenMobile Database

For XenMobile environment 10.4 and below, we do not have the option to delete the user from the console.You will have to delete the user from the database manually. Use the following SQL query to delete all rows associated to a single user within XenMobile Server. Important! Ensure to back up the...

phpDolphin 2.0.5 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: phpDolphin http://target.com/index.php?a=search&q=teste&filter=m"XSS CSRF ==== We've found no protection against CSRF Cross-site Request Forgery, which made possible to do any kind of act on a user or admin account. NO FORMS are...

CVE-2015-2970

index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allows remote attackers to delete arbitrary files via the oekakis parameter...

CVE-2014-2062

Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to retain access via the token...

Design/Logic Flaw

Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to retain access via the token...

jenkins: user tokens not invalidated correctly (SECURITY-89)

Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to retain access via the token...

Wordpress Bulk Delete Users by Email Plugin 1.0 - CSRF

No description provided by source. Exploit Title: Bulk Delete Users by Email, Wordpress Plugin 1.0 - CSRF Google Dork: N/A Date: 05.09.2014 Exploit Author: Fikri Fadzil - [email protected] Vendor Homepage - http://www.speakdigital.co.uk/ Software Link:...