CVE-2019-13349

In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes...

Eventum Cross-Site Request Forgery Vulnerability

Eventum is a defect tracking system. The system is used to track inbound technical support, organizational tasks, bugs, etc. A cross-site request forgery vulnerability exists in the htdocs/manage/users.php file in Eventum version 3.5.0, which stems from a WEB application that does not adequately...

CVE-2018-20590

Ivan Cordoba Generic Content Management System CMS through 2018-04-28 has XSS via the Administrator/users.php user ID...

CVE-2018-15713

Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php...

CVE-2016-10732

ProjectSend formerly cFTP r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?fileid=1, or process-zip-download.php, or adduserform parameters to users-add.php...

CVE-2018-17085

An issue was discovered in OTCMS 3.61. XSS exists in admin/users.php via these parameters: dataTypeCN dataMode dataModeStr...

CVE-2018-17085

An issue was discovered in OTCMS 3.61. XSS exists in admin/users.php via these parameters: dataTypeCN dataMode dataModeStr...

Information Disclosure Via Privilege Escalation

Moodle is vulnerable to information disclosure through privilege escalation attacks. Sensitive information from hidden fields is accessible to authenticated users when a user with the Teacher role navigates to the Enrolled users page in user settings...

Multiple Huawei server information leakage vulnerabilities

Huawei Tecal RH1288 V2 and others are servers from Huawei, a Chinese company. An information disclosure vulnerability exists in several Huawei servers. The vulnerability can be exploited by an attacker to view the session IDs of all online users in the Online Users page of the Web UI...

WordPress Plugin Private Messages SQL Injection Vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . A SQL injection vulnerability exists in the readid parameter of the users.php page in version 1.0.1 of the...

SQL injection vulnerability in CircleManage/FindUsers.aspx page of ECTS website building system of Shanghai Hongyu Information Technology Co.

ECS ECS education site system is a general-purpose CMS program developed by Shanghai Hongyu Information Technology Co., Ltd. for schools, education and other site-building system. A SQL injection vulnerability exists in the CircleManage/FindUsers.aspx page of the product, which can be exploited t...

CVE-2014-9570

Multiple cross-site scripting XSS vulnerabilities in the MyWebsiteAdvisor Simple Security plugin 1.1.5 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 datefilter parameter in the accesslog page to wp-admin/users.php or 2 simplesecurityipblacklist...

CVE-2014-100018

Cross-site scripting XSS vulnerability in the Unconfirmed plugin before 1.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in the unconfirmed page to wp-admin/network/users.php...

Microsoft Dynamics CRM Cross-Site Scripting Vulnerability

Microsoft Dynamics CRM is a fully integrated customer relationship management CRM system. A cross-site scripting vulnerability exists in Microsoft Dynamics CRM 2013 SP1. Because the script passed to "/Biz/Users/AddUsers/SelectUsersPage.aspx" fails to adequately filter user-supplied input, a remot...

Xbtit 2.0.0 - SQL Injection

Title : Xbtit SQL Injection Vulnerability Author : Ctacok Homepage : http://ctacok.ru/ Vulnerable File : /index.php?page=users&order=SQL&by=ASC ExploiT :...

Sql injection

Multiple SQL injection vulnerabilities in CMScout 2.06 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to 1 index.php in a mythings page mythings.php and 2 the users page in admin.php...