101 matches found
CVE-2024-35050
CVE-2024-35050 concerns SurveyKing v1.3.1, where an attacker can escalate privileges by re-using a session ID belonging to a user that Admin has deleted. The Red Hat/PT security entries corroborate the same issue and specify SurveyKing 1.3.1 as affected. A practical workaround suggested in PT-202...
CVE-2024-2405
The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack...
CVE-2021-46903
An issue was discovered in LTOS-Web-Interface in Meinberg LANTIME-Firmware before 6.24.029 MBGID-9343 and 7 before 7.04.008 MBGID-6303. An admin can delete required user accounts in violation of expected access control...
CVE-2023-6625 Product Enquiry for WooCommerce < 3.1 - Arbitrary Enquiry Deletion via CSRF
The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could allow attackers to make a logged in admin delete them via a CSRF attack...
CVE-2023-45083
An Improper Privilege Management vulnerability exists in HyperCloud that will impact the ability for a user to authenticate against the management plane. An authenticated admin-level user may be able to delete the "admin" or "serveradmin" users, which prevents authentication from subsequently...
PT-2023-29400 · Unknown · Hypercloud
Name of the Vulnerable Software and Affected Versions: HyperCloud versions 1.0 through 2.0 Description: An Improper Privilege Management issue exists that impacts user authentication against the management plane. An authenticated admin-level user may be able to delete the admin or serveradmin...
PT-2023-25498 · Unknown · Projectworlds Online Examination System
Name of the Vulnerable Software and Affected Versions: The Online Examination System Project version 1.0 Description: The issue allows an attacker to perform Cross-Site Request Forgery CSRF attacks. An attacker can create a malicious link that, when clicked by an admin user, will delete a user...
CVE-2023-2842
The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack...
Cross site request forgery (csrf)
The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers IdP, which could allow attackers to make logged in admins delete all IdP via a CSRF attack...
WordPress plugin WP OAuth Server 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...
PT-2023-14784 · Fortinet · Fortigate +1
Name of the Vulnerable Software and Affected Versions: FortiManager versions 6.4.6 and below Description: The issue is related to an incorrect user management vulnerability in the VDOM creation component. This may allow an attacker to access a FortiGate without a password via newly created VDOMs...
PT-2022-26504 · WordPress · Bulk Delete Users By Email
Name of the Vulnerable Software and Affected Versions: Bulk Delete Users by Email WordPress plugin versions 1.2 and earlier Description: The issue concerns a lack of CSRF check when deleting users, which could allow attackers to make a logged-in admin delete non-admin users by knowing their email...
CVE-2022-3763
The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not have CSRF check in place when deleting files uploaded at the checkout, allowing attackers to make a logged in...
CVE-2022-2275
The WP Edit Menu WordPress plugin before 1.5.0 does not have CSRF in an AJAX action, which could allow attackers to make a logged in admin delete arbitrary posts/pages from the blog via a CSRF attack...
CVE-2022-2388
The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a logged in admin delete arbitrary ones via a CSRF attack...
Cross site request forgery (csrf)
The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a logged in admin delete arbitrary ones via a CSRF attack...
CVE-2022-38359
Cross-site request forgery attacks can be carried out against the Eyes of Network web application, due to an absence of adequate protections. An attacker can, for instance, delete the admin user by directing an authenticated user to the URL...
CVE-2022-23061
In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin although this cannot happen according to the documentation via Insecure Direct Object Reference IDOR vulnerability...
Business Logic Errors
Description Product status of product is unpublished has been deleted by admin in Trash folder but user can still add to cart and make purchases Proof of Concept Step 1: Admin go to Shop Products: Unpublish product and Delete product Step 2: User add product to cart by request POST...