CVE-2021-40577

CVE-2021-40577 is a stored XSS vulnerability in the Sourcecodester Online Enrollment Management System in PHP and PayPal Free Source Code 1.0, affecting the Add-Users page via the Name parameter. The issue arises from storing unsanitized input that is later reflected, enabling a persistent script...

CVE-2021-40577: Improper Neutralization of Input During Web Page Generation

A Stored Cross Site Scripting XSS vulnerability exists in Sourcecodester Online Enrollment Management System in PHP and PayPal Free Source Code 1.0 in the Add-Users page via the Name parameter...

PT-2021-5955

Name of the Vulnerable Software and Affected Versions Sourcecodester Online Enrollment Management System in PHP and PayPal Free Source Code version 1.0 Description A Stored Cross Site Scripting XSS issue exists in the Add-Users page via the Name parameter, allowing a remote attacker to perform...

CVE-2021-28053

An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A SQL injection vulnerability in "Configuration Users Contacts / Users" allows remote authenticated users to execute arbitrary SQL commands via the Additional Information parameters...

CVE-2021-29025

A cross-site scripting XSS vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/myimages.php URI...

CVE-2021-3165

SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the //CampaignManager/users URI...

PT-2022-5110 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle versions affected versions not specified Description: A limited SQL injection risk was identified in the "browse list of users" site administration page. The vulnerability is related to insufficient cleaning of user data on this page...

CVE-2020-6586

Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered...

CVE-2020-6586: Improper Neutralization of Input During Web Page Generation

Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered...

CVE-2019-13349

In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes...

Eventum Cross-Site Request Forgery Vulnerability

Eventum is a defect tracking system. The system is used to track inbound technical support, organizational tasks, bugs, etc. A cross-site request forgery vulnerability exists in the htdocs/manage/users.php file in Eventum version 3.5.0, which stems from a WEB application that does not adequately...

CVE-2018-20590

Ivan Cordoba Generic Content Management System CMS through 2018-04-28 has XSS via the Administrator/users.php user ID...

CVE-2018-15713

Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php...

CVE-2016-10732

ProjectSend formerly cFTP r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?fileid=1, or process-zip-download.php, or adduserform parameters to users-add.php...

CVE-2018-17085

An issue was discovered in OTCMS 3.61. XSS exists in admin/users.php via these parameters: dataTypeCN dataMode dataModeStr...

CVE-2018-17085

An issue was discovered in OTCMS 3.61. XSS exists in admin/users.php via these parameters: dataTypeCN dataMode dataModeStr...

Information Disclosure Via Privilege Escalation

Moodle is vulnerable to information disclosure through privilege escalation attacks. Sensitive information from hidden fields is accessible to authenticated users when a user with the Teacher role navigates to the Enrolled users page in user settings...

Multiple Huawei server information leakage vulnerabilities

Huawei Tecal RH1288 V2 and others are servers from Huawei, a Chinese company. An information disclosure vulnerability exists in several Huawei servers. The vulnerability can be exploited by an attacker to view the session IDs of all online users in the Online Users page of the Web UI...

CVE-2014-9691: Exposure of Sensitive Information to an Unauthorized Actor

Huawei Tecal RH1288 V2 V100R002C00SPC107 and earlier versions, Tecal RH2265 V2 V100R002C00, Tecal RH2285 V2 V100R002C00SPC115 and earlier versions, Tecal RH2265 V2 V100R002C00, Tecal RH2285H V2 V100R002C00SPC111 and earlier versions, Tecal RH2268 V2 V100R002C00, Tecal RH2288 V2 V100R002C00SPC117...

PT-2017-8626

Name of the Vulnerable Software and Affected Versions Cloudera HUE versions 3.9.0 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the First name or Last name field in the HUE Users page, potentially leading to cross-site scripting XSS attacks...