PT-2018-12285

Name of the Vulnerable Software and Affected Versions Creatiwity wityCMS version 0.6.2 Description A CSRF issue exists in the admin/user/edit endpoint of Creatiwity wityCMS, allowing an attacker to take control of a user account by modifying the account's email field. Recommendations For Creatiwi...

CVE-2018-14029: Cross-Site Request Forgery (CSRF)

CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account, as demonstrated by modifying the account's email field...

PT-2018-4118 · Manageiq +1 · Manageiq +1

Name of the Vulnerable Software and Affected Versions: ManageIQ affected versions not specified Red Hat CloudForms Management Engine CFME affected versions not specified Description: The issue allows remote authenticated users to bypass authorization and gain privileges. This is due to improper...

CVE-2017-17903

FS Lynda Clone has CSRF via user/editprofile, as demonstrated by adding content to the user panel...

CVE-2017-17904

FS Lynda Clone has XSS via the keywords parameter to tutorial/ or the editprofilefirstname parameter to user/editprofile...

FS Lynda Clone Cross-Site Request Forgery Vulnerability

FS Lynda Clone is a video tutorial software developed with jQuery, PHP and MySQL. FS Lynda Clone suffers from a cross-site request forgery vulnerability. An attacker can exploit this vulnerability to conduct cross-site request forgery attacks via user/editprofile...

PT-2017-15087

Name of the Vulnerable Software and Affected Versions FS Lynda Clone affected versions not specified Description The issue allows for CSRF via the "user/edit profile" API endpoint, as demonstrated by adding content to the user panel. Recommendations At the moment, there is no information about a...

Xavier PHP Management Panel SQL Injection Vulnerability

Xavier PHP Management Panel is a PHP-based web content protection script. A SQL injection vulnerability exists in Xavier PHP Management Panel version 2.4. A remote attacker can inject malicious SQL commands into the admin/adminuseredit.php file by sending the 'usertoedit' parameter or the...

CVE-2017-15949

Xavier PHP Management Panel 2.4 allows SQL injection via the usertoedit parameter to admin/adminuseredit.php or the logid parameter to admin/editgroup.php...

WordPress 2.9.2-4.8.1 - Open Redirect

Description An open redirect was discovered on the user and term edit screens. Reported by Yasin Soliman ysx...

DEBIAN-CVE-2017-14725

Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php...

WordPress <=4.8.1 - Open redirect vulnerability (user and term edit screens)

Open redirect vulnerability found by Yasin Soliman ysx in WordPress user and term edit screens version 4.8.1 and earlier versions. Solution Update the WordPress to the latest available version at least 4.8.2...

Cross-Site Scripting (XSS)

craftcms/cms is susceptible to cross-site scripting XSS attacks. These attacks exist because the application displays the first name, last name and user name on the user index and user edit pages without properly encoding them...

Ignite Realtime Openfire Elevation of Privilege Vulnerability

Ignite Realtime Openfire formerly known as Wildfire is the IgniteRealtime community of a Java development and based on XMPP formerly known as Jabber, Instant Messaging Protocol cross-platform open-source real-time collaboration RTC server , it can build a high-efficiency instant messaging servers...

Code injection

Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp...

CVE-2015-7707

Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp...

PT-2015-7588

Name of the Vulnerable Software and Affected Versions Ignite Realtime Openfire version 3.10.2 Description The issue allows remote authenticated users to gain administrator access. This is achieved by exploiting the isadmin parameter in the "user-edit-form.jsp" endpoint. Recommendations For Ignite...

Suning a backstage bypass arbitrary file upload-vulnerability warning-the black bar safety net

http://58.213.19.68/users/signin Suning Plaza phone the client back-end management system http://58.213.19.68/users/signup you can register for an account Then login ! Snip2015010713. png Point into the background is not entitled to limit access, but the system using rb to develop The error...

CFME: check_privileges logic error resulting in privilege escalation

The checkprivileges method in vmdb/app/controllers/applicationcontroller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine CFME, allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbacuseredit action...

SyndeoCMS <= 3.0.01 Persistent XSS Vulnerability

Exploit for php platform in category web applications +---------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : SyndeoCMS = 3.0.01 Persistent XSS Date : 29-03-2012 Author : Ivano Binetti...