CVE-2019-18223

The CVE-2019-18223 entry concerns Zoom Call Recording (version 6.3.1) and describes authenticated stored XSS vulnerabilities. Multiple input vectors are identified, including: (1) phoneNumber in User Edit/Add forms, (2) name in Role Add form, (3) name or number in Edit Group, (4) tagKey/tagValue ...

PT-2020-20670

Name of the Vulnerable Software and Affected Versions RegistrationMagic plugin versions prior to 4.6.0.4 Description The issue allows remote authenticated users with minimal privileges to elevate their privileges to administrator. This is achieved through the user controller in the class rm user...

LiteCart Cross-Site Request Forgery Vulnerability

LiteCart is a lightweight e-commerce platform for online merchants developed using PHP, HTML 5 and CSS 3. A cross-site request forgery vulnerability exists in LiteCart 2.2.1 and earlier versions in admin/?app=users&doc=edituser. An attacker can exploit this vulnerability to add users...

Phabricator: User can link non-public file attachments, leading to file disclose on edit by higher-privileged user

CVSS ---- Medium 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Description ----------- Uploaded files can be linked to from anywhere by referencing their ID. If the user viewing the reference to the file has permission to access the file, it will be rendered. Otherwise, the reference will be...

Cross site request forgery (csrf)

An issue was discovered in CyberPanel through 1.8.4. On the user edit page, an attacker can edit the administrator's e-mail and password because of the lack of CSRF protection...

CVE-2019-13056: Cross-Site Request Forgery (CSRF)

An issue was discovered in CyberPanel through 1.8.4. On the user edit page, an attacker can edit the administrator's e-mail and password because of the lack of CSRF protection...

PT-2019-9675

Name of the Vulnerable Software and Affected Versions Vignette Content Management version 6 Description The issue allows for remote access to administrator privileges by discovering the admin password in the "vgn/ccb/user/mgmt/user/edit/0,1628,0,00.html?uid=admin" HTML source code, and then...

CVE-2018-18797

School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php...

CVE-2018-18797

CVE-2018-18797 affects School Attendance Monitoring System 1.0. The vulnerability is a Cross-Site Request Forgery (CSRF) via /user/user/edit.php that enables an attacker to trigger admin data updates (e.g., account fields) by forged requests. Public exploit references (Exploit-DB, PacketStorm) an...

PT-2018-14428

Name of the Vulnerable Software and Affected Versions Advanced HRM version 1.6 Description The issue allows for Remote Code Execution via PHP code in a .php file to the "user/update-user-avatar" URI. This can be accessed through an "Update Profile" "Change Picture" action, also known as...

CVE-2018-18382: Unrestricted Upload of File with Dangerous Type

Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" aka user/edit-profile action...

MicroPyramid Django-CRM Cross-Site Request Forgery Vulnerability

MicroPyramid Django-CRM is an open source customer relationship management system CRM based on the Django framework . A cross-site request forgery vulnerability exists in the /users/create/, /users//edit/, and /accounts//delete/ URIs in MicroPyramid Django-CRM version 0.2. A remote attacker can...

CVE-2018-16447

Frog CMS 0.9.5 has admin/?/user/edit/1 CSRF...

PT-2018-13574

Name of the Vulnerable Software and Affected Versions Frog CMS version 0.9.5 Description The issue concerns a CSRF vulnerability in the admin interface, specifically affecting the "user/edit/1" endpoint. This could potentially allow unauthorized actions to be performed on user accounts...

CVE-2018-16447: Cross-Site Request Forgery (CSRF)

Frog CMS 0.9.5 has admin/?/user/edit/1 CSRF...

Monstra-Dev 3.0.4 - Cross-Site Request Forgery (Account Hijacking)

Exploit Title: Monstra-Dev 3.0.4 - Cross-Site Request ForgeryAccount Hijacking Date: 2018-08-04 Exploit Author: Nainsi Gupta Vendor Homepage: http://monstra.org/ Product Name: Monstra-dev Version: 3.0.4 Tested on: Windows 10 Firefox/Chrome CVE : N/A 1. Description CSRF vulnerability in...

ekobroucek.cz Cross Site Request Forgery vulnerability

Open Bug Bounty ID: OBB-656150 Description| Value ---|--- Affected Website:| ekobroucek.cz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| CSRF Cross-Site Request Forgery / CWE-352 CVSSv3 Score:| 8.8...

rondony.cz Cross Site Request Forgery vulnerability

Open Bug Bounty ID: OBB-655177 Description| Value ---|--- Affected Website:| rondony.cz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| CSRF Cross-Site Request Forgery / CWE-352 CVSSv3 Score:| 8.8...

Cross site request forgery (csrf)

CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account, as demonstrated by modifying the account's email field...

CVE-2018-14029

CVE-2018-14029 : CSRF in the WityCMS 0.6.2 admin/user/edit flow allows an attacker to take over a user account by modifying user data (e.g., email, password). The vulnerability stems from cross-site request forgery in the admin interface, with CVSSv3 base score 8.8 (HIGH) and user interaction req...