CVE-2019-8437

njiandan-cms through 2013-05-23 has index.php/admin/usernew CSRF to add an administrator...

CVE-2019-9625

JBMC DirectAdmin 1.55 allows CSRF via the /CMDACCOUNTADMIN URI to create a new admin account...

LayerBB 1.1.2 - Cross-Site Request Forgery (Add Admin)

LayerBB 1.1.2 - Cross-Site Request Forgery Add Admin Exploit Title: LayerBB 1.1.2 - Cross-Site Request Forgery Date: 10/4/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://forum.layerbb.com Version: 1.1.2 Tested on: Ubuntu 18.04 CVE: CVE-2018-17996 1. Description:...

HisiPHP Cross-Site Request Forgery Vulnerability

HisiPHP is a set of rapid development framework based on ThinkPHP and Layui, which integrates permission management, module management, plugin management and database management. A cross-site request forgery vulnerability exists in HisiPHP version 1.0.8, which stems from the...

CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

CVE-2018-12464

A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database. This can be exploited to create an administrative account and used in...

Stored Cross-site Scripting Vulnerability in KesionCMS Frontend ChangesUrl Parameter

KesionCMS intelligent website building system is a set of intelligent website building system developed by Xiamen Kesion Software Ltd. using ASP+ACCESS/MSSQL database architecture. There is a stored cross-site scripting vulnerability in the frontend of KesionCMS, as the frontend page...

Joomla! 2.5.2 - Admin Creation Exploit

Exploit for php platform in category web applications !/usr/bin/python3 CVE-2012-1563: Joomla! = 2.5.2 Admin Creation cf import bs4 import requests import random url = 'http://vmweb.lan/joomla-cms-2.5.2/' formurl = url +...

Joomla! < 2.5.2 - Admin Creation

!/usr/bin/python3 CVE-2012-1563: Joomla! = 2.5.2 Admin Creation cf Source: https://www.ambionics.io/blog/cve-2016-9838-joomla-account-takeover-and-remote-code-execution import bs4 import requests import random url = 'http://vmweb.lan/joomla-cms-2.5.2/' formurl = url +...

Joomla! 2.5.2 - Admin Creation

Joomla! 2.5.2 - Admin Creation !/usr/bin/python3 CVE-2012-1563: Joomla! = 2.5.2 Admin Creation cf Source: https://www.ambionics.io/blog/cve-2016-9838-joomla-account-takeover-and-remote-code-execution import bs4 import requests import random url = 'http://vmweb.lan/joomla-cms-2.5.2/' formurl = url...

ApPHP MicroCMS 3.9.5 Cross Site Request Forgery

Exploit Title :----------------- : ApPHP MicroCMS 3.9.5 - Cross-Site Request Forgery Add Admin Main Author :------------------------ : Besim Google Dork :---------------- : - Date :-------------------------- : 12/10/2016 Type :-------------------------- : webapps Platform : -------------------- :...

CSRF Vulnerability in YxCMS v1.3.7

YXcms is a website management system based on PHP+MySql with a lightweight MVC design model. A CSRF vulnerability exists in the controller call location of YxCMS version 1.3.7. An attacker can exploit the vulnerability to write arbitrary code, and can use the edited php template file to replace t...

RaiseDreams Crowdfunding System version 2.2.4 SQL Injection Vulnerability in '/User/Handler1.ashx' File

RaiseDreams is an enterprise-level crowdfunding website platform. A SQL injection vulnerability exists in the '/User/Handler1.ashx' file in version 2.2.4 of the RaiseDreams Crowdfunding System, which allows an attacker to exploit the vulnerability to execute SQL statements, as well as add a super...

Nagios Network Analyzer 2.2.1 - Multiple Cross-Site Request Forgery Vulnerabilities

Credits: John Page hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NAGIOS-NA-v2.2.1-MULTIPLE-CSRF.txt + ISR: ApparitionSec Vendor: =============== www.nagios.com Product: ============================== Nagios Network Analyzer v2.2.1 Netflow...

FiverrScript Cross-Site Request Forgery Vulnerability

FiverrScript is a set of Fiverr scripts used to create websites. The FiverrScript administrator/adminscreate.php scripts are vulnerable to cross-site request forgery, which allows remote attackers to construct malicious URIs and trick users into parsing them, which can be used to perform maliciou...

WordPress <= 1.5.1.1 - "add new admin" SQL Injection

...

Front Accounting 2.3.4 CSRF Vulnerability

No description provided by source. Software................Front Accounting 2.3.4 Vulnerability...........Cross-site Request Forgery Threat Level............Low 1/5 Download................http://frontaccounting.com/wb3/ Discovery Date..........4/27/2011 Tested On...............Windows Vista +...

AIOCP 1.4.001 CSRF Vulnerability

No description provided by source. Source: http://packetstormsecurity.org/files/view/98247/AIOCP-1.4.001-xsrf.txt !------------------------------------------------------------------------ Software................AIOCP All In One Control Panel 1.4.001 Vulnerability...........Cross-site Request...

VamCart 0.9 - Cross-Site Request Forgery

VamCart 0.9 - Cross-Site Request Forgery Exploit Title: VamCart v0.9 CSRF Vulnerability Date: 20/08/2012 Author: DaOne Software Link: http://vamcart.googlecode.com/files/vamcart.zip Greetings to: LCA CSRF Add Admin:...

Front Accounting 2.3.4 CSRF Vulnerability

Exploit for php platform in category web applications Software................Front Accounting 2.3.4 Vulnerability...........Cross-site Request Forgery Threat Level............Low 1/5 Download................http://frontaccounting.com/wb3/ Discovery Date..........4/27/2011 Tested...