566 matches found
CVE-2019-7348: Improper Neutralization of Input During Web Page Generation
Self - Stored Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'username' parameter value in the view user user.php because proper filtration is omitted...
CVE-2019-6126: Direct Request
The Admin Panel of PHP Scripts Mall Advance Peer to Peer MLM Script v1.7.0 allows remote attackers to bypass intended access restrictions by directly navigating to admin/dashboard.php or admin/user.php, as demonstrated by disclosure of information about users and staff...
Sql injection
CrashFix 1.0.4 has SQL Injection via the Userstatus parameter. This is related to actionIndex in UserController.php, and the protected\models\User.php search function...
CVE-2018-20508
CrashFix 1.0.4 has SQL Injection via the Userstatus parameter. This is related to actionIndex in UserController.php, and the protected\models\User.php search function...
CVE-2018-20508
CVE-2018-20508 affects CrashFix 1.0.4 with a SQL Injection vulnerability exploitable via the User[status] parameter. The issue is tied to actionIndex in UserController.php and the protected\models\User.php search() function. The connected documents confirm the vulnerability detail but do not prov...
CVE-2018-20508
CrashFix 1.0.4 has SQL Injection via the Userstatus parameter. This is related to actionIndex in UserController.php, and the protected\models\User.php search function...
CVE-2018-20508: Improper Neutralization of Special Elements used in an SQL Command
CrashFix 1.0.4 has SQL Injection via the Userstatus parameter. This is related to actionIndex in UserController.php, and the protected\models\User.php search function...
CVE-2018-1000870: Improper Neutralization of Input During Web Page Generation
PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerability in /app/admin/users/print-user.php that can result in Execute code in the victims browser. This attack appear to be exploitable via Attacker change theme parameter in user settings. AdminVictim views user in admin-panel and gets...
PT-2018-14722
Name of the Vulnerable Software and Affected Versions AbiSoft Ticketly version 1.0 Description The issue allows remote attackers to create administrator accounts. This can be achieved via an action/add user.php POST request, specifically exploiting the add user functionality. Recommendations For...
CVE-2018-18316
emlog v6.0.0 has CSRF via the admin/user.php?action=new URI...
CVE-2018-18316
emlog v6.0.0 has CSRF via the admin/user.php?action=new URI...
Cross site request forgery (csrf)
emlog v6.0.0 has CSRF via the admin/user.php?action=new URI...
CVE-2018-18316
emlog v6.0.0 has CSRF via the admin/user.php?action=new URI...
CVE-2018-18316
Affected software: emlog. Vulnerability: CSRF via the admin/user.php?action=new URI in emlog v6.0.0. Root cause/impact: CSRF could allow unauthorized actions; the connected documents only state the CSRF issue with that URI and do not provide deeper technical specifics, affected modules beyond adm...
Academic Timetable Final Build 7.0b - Cross-Site Request Forgery (Add Admin) Vulnerability
Exploit for php platform in category web applications Exploit Title: Academic Timetable Final Build 7.0b - Cross-Site Request Forgery Add Admin Dork: N/A Date: 2018-10-13 Exploit Author: Ihsan Sencan Vendor Homepage: http://geoffpartridge.net/ Software Link:...
MaxOn ERP Software 8.x-9.x - 'nomor' SQL Injection
Exploit Title: MaxOn ERP Software 8.x-9.x - 'nomor' SQL Injection Dork: N/A Date: 2018-10-15 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.talagasoft.com Software Link: http://demo.maxonerp.com/ Software Download: https://datapacket.dl.sourceforge.net/project/maxon/maxon.rar Version:...
MaxOn ERP Software 8.x-9.x - nomor SQL Injection
MaxOn ERP Software 8.x-9.x - nomor SQL Injection Exploit Title: MaxOn ERP Software 8.x-9.x - 'nomor' SQL Injection Dork: N/A Date: 2018-10-15 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.talagasoft.com Software Link: http://demo.maxonerp.com/ Software Download:...
MaxOn ERP Software 8.x-9.x - nomor SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: MaxOn ERP Software 8.x-9.x - 'nomor' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: http://www.talagasoft.com Software Link: http://demo.maxonerp.com/ Software Download:...
MaxOn ERP Software 8.x / 9.x SQL Injection
Exploit Title: MaxOn ERP Software 8.x-9.x - 'nomor' SQL Injection Dork: N/A Date: 2018-10-15 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.talagasoft.com Software Link: http://demo.maxonerp.com/ Software Download: https://datapacket.dl.sourceforge.net/project/maxon/maxon.rar Version:...