CVE-2018-16387

Elefant CMS prior to version 2.0.5 contains a CSRF vulnerability that can add a user account via the /user/add endpoint. The issue is documented across multiple disclosures (including CVE-2018-16387 and related advisories) and is confirmed by the NVD entry for CVE-2018-16387. The available descri...

CVE-2018-16387

An issue was discovered in Elefant CMS before 2.0.5. There is a CSRF vulnerability that can add an account via user/add...

idreamsoft iCMS Cross-Site Request Forgery Vulnerability (CNVD-2019-10137)

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in admincp.php?app=group&do=save in idreamsoft iCMS 7.0.10, which can be exploited by an attacker to add an administrator account...

CVE-2018-16349

WUZHI CMS 4.1.0 has XSS via the index.php?m=link&f=index&v=add formremark parameter...

Design/Logic Flaw

WUZHI CMS 4.1.0 has XSS via the index.php?m=link&f=index&v=add formremark parameter...

CVE-2018-16339

An issue was discovered in EmpireCMS 7.0. There is a CSRF vulnerability that can add administrators via upload/e/admin/user/AddUser.php?enews=AddUser...

CVE-2018-16315

In waimai Super Cms 20150505, there is a CSRF vulnerability that can change the configuration via admin.php?m=Config&a=add...

RICOH MP C4504ex Printer - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for hardware platform in category web applications Exploit Title: RICOH MP C4504ex Printer - Cross-Site Request Forgery Add Admin Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.ricoh.com/ Hardware Link :...

Gleez CMS 1.2.0 - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for php platform in category web applications Exploit Title: Gleez CMS 1.2.0 - Cross-Site Request Forgery Add Admin Exploit Author: GunEggWang Vendor Homepage: https://gleezcms.org/ Software Link: https://github.com/gleez/cms Version: 1.2.0 CVE : CVE-2018-15845 Description: There is a CSR...

RICOH MP C4504ex Printer - Cross-Site Request Forgery (Add Admin)

RICOH MP C4504ex Printer - Cross-Site Request Forgery Add Admin Exploit Title: RICOH MP C4504ex Printer - Cross-Site Request Forgery Add Admin Date: 2018-08-21 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.ricoh.com/ Hardware Link :...

RICOH MP C4504ex Cross Site Request Forgery

Exploit Title: RICOH MP C4504ex Printer - Cross-Site Request Forgery Add Admin Date: 2018-08-21 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.ricoh.com/ Hardware Link :...

Gleez CMS 1.2.0 - Cross-Site Request Forgery (Add Admin)

Exploit Title: Gleez CMS 1.2.0 - Cross-Site Request Forgery Add Admin Date: 2018-08-24 Exploit Author: GunEggWang Vendor Homepage: https://gleezcms.org/ Software Link: https://github.com/gleez/cms Version: 1.2.0 CVE : CVE-2018-15845 Description: There is a CSRF vulnerability that can add an...

Flexo CMS Cross-Site Request Forgery Vulnerability

Flexo CMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in Flexo CMS version 0.1.6. An attacker can exploit this vulnerability to add an administrator account with the help of the /admin/user/add page...

CVE-2018-15847

An issue was discovered in puppyCMS 5.1. There is an XSS vulnerability via menu.php in the "Add Page/URL" URL link field...

CVE-2018-15843

GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field...

CVE-2018-15845

There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add...

Design/Logic Flaw

GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field...

Cross site scripting

An issue was discovered in puppyCMS 5.1. There is an XSS vulnerability via menu.php in the "Add Page/URL" URL link field...

CVE-2018-15842

WolfCMS 0.8.3.1 has XSS via the /?/admin/page/add slug parameter...

CVE-2018-15847

CVE-2018-15847 affects puppyCMS 5.1: an XSS vulnerability exists in menu.php via the "Add Page/URL" field. The issue allows injection of JavaScript through that link field, as described by multiple sources (NVD/CNVD). CVSS metrics indicate a MEDIUM severity risk (base score 6.1/3.0; network attac...