2870 matches found
CVE-2022-1791: Cross-Site Request Forgery (CSRF)
The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable / hide the badge of the available updates and the related check...
Reddit: Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application.
ads.reddit.com is an ads creating and managing application for reddit. The application has the feature to invite other members to the organization and give different roles at ad management. Testing around the role management functionalities, I have noticed that a user with the same email can get...
CVE-2022-30898
A Cross-site request forgery CSRF vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password...
Account takeover due to stored XSS in "Project Title"
Description The Project "Title" of the NocoDB application is vulnerable to stored xss which can leads to admin account takeover. Proof of Concept Login with low privileged users and Click on "New Project" then click on "Create" Now write the payload and again click on "Create" Then login from sup...
Authentication flaw
A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account when an attacker hijacks a session. Affected Products: Wiser Smart, EER21000 & EER21001 V4.5 and prior...
CVE-2022-30238
A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account when an attacker hijacks a session. Affected Products: Wiser Smart, EER21000 & EER21001 V4.5 and prior...
CVE-2022-30238: Improper Authentication
A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account when an attacker hijacks a session. Affected Products: Wiser Smart, EER21000 & EER21001 V4.5 and prior...
CVE-2022-29647
An issue was discovered in MCMS 5.2.7. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do...
CVE-2022-29647
MCMS 5.2.7 is affected by a Cross-Site Request Forgery (CSRF) vulnerability that enables an attacker to add an administrator account via the path ms/basic/manager/save.do. Public sources in the connected set consistently describe this flaw in MingSoft MCMS and detail the injection vector through ...
qdPM 9.1 - Remote Code Execution (Authenticated) Exploit
Exploit Title: qdPM 9.1 - Remote Code Execution RCE Authenticated Google Dork: intitle:qdPM 9.1. Copyright © 2020 qdpm.net Original Exploit Author: Rishal Dwivedi Loginsoft Original ExploitDB ID: 47954 https://www.exploit-db.com/exploits/47954 Exploit Author: Leon Trappett thepcn3rd Vendor...
EC-CUBE Cross-site request forgery (CSRF) vulnerability
Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...
GHSA-842M-VP3R-QWWR ThinkCMF Cross Site Request Forgerly (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability in ThinkCMF, which can add an admin account...
ThinkCMF Cross Site Request Forgerly (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability in ThinkCMF, which can add an admin account...
Dolibarr stored Cross-site Scripting vulnerability
In Dolibarr 10.0.6, if USERLOGINFAILED is active, there is a stored XSS vulnerability on the admin tools -- audit page. This may lead to stealing of the admin account...
GHSA-Q938-82FW-WFCF Dolibarr stored Cross-site Scripting vulnerability
In Dolibarr 10.0.6, if USERLOGINFAILED is active, there is a stored XSS vulnerability on the admin tools -- audit page. This may lead to stealing of the admin account...
GHSA-4QQ9-QG7J-FCM9 Dolibarr Cross-Site Request Forgery (CSRF)
An issue was discovered in Dolibarr. A user can store an IFRAME element containing a user/card.php CSRF request in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. The protection mechanism for CSRF is to check the Referer header; howeve...
Dolibarr Cross-Site Request Forgery (CSRF)
An issue was discovered in Dolibarr. A user can store an IFRAME element containing a user/card.php CSRF request in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. The protection mechanism for CSRF is to check the Referer header; howeve...
CVE-2022-29002
CVE-2022-29002 affects XXL-Job v2.3.0, where CSRF in the /gaia-job-admin/user/add component allows an attacker to arbitrarily create administrator accounts. The linked sources (CNVD/OSV/GHSA/Red Hat/OSV) consistently describe lack of filtering/restrictions in that endpoint as the root cause. No r...
