Coupon Affiliates for WooCommerce < 4.11.3.4 - Arbitrary Referral Visits Deletion via CSRF

The plugin does not have any CSRF in place when deleting Referral Visits, which could allow attackers to make a logged in admin delete them via a CSRF attack PoC...

Cross-Site Request Forgery (CSRF) in zhongshaofa/easyadmin

✍️ Description Attacker able to delete any admin with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attacks i...

CVE-2020-14501

Advantech iView, versions 5.6 and prior, has an improper authentication for critical function CWE-306 issue. Successful exploitation of this vulnerability may allow an attacker to obtain the information of the user table, including the administrator credentials in plain text. An attacker may also...

CVE-2020-10497

CSRF in admin/manage-categories.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a category via a crafted request...

CVE-2020-8425

Cups Easy Purchase & Inventory 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php...

Design/Logic Flaw

NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user...

NoneCMS Cross-Site Request Forgery Vulnerability (CNVD-2019-35786)

NoneCMS is a content management system CMS based on Thinkphp. A cross-site request forgery vulnerability exists in the public/index.php/admin/admin/dele.html page in NoneCMS v1.3, which can be exploited by an attacker to send an unintended request to the server via an affected client...

PHPSHE SQL Injection Vulnerability

PHPSHE is an online shopping mall system. The system supports express tracking, online chat, order evaluation and statistics. A SQL injection vulnerability exists in the admin.php?mod=user&act=del script in PHPSHE version 1.7. A remote attacker can exploit this vulnerability to execute arbitrary...

CVE-2018-1000514

LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery CSRF vulnerability in Boxes that can result in CSRF admins to delete boxes. This vulnerability appears to have been fixed in 3.6.x...

Yxcms Cross-Site Request Forgery Vulnerability

Yxcms is an efficient, flexible, practical and free enterprise building system, based on PHP and mysql technology. YXcms 1.4.7 in the protected/apps/admin/controller/adminController.php cross-site request forgery vulnerability. A remote attacker can exploit this vulnerability by deleting the...

CVE-2017-14587

The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the uname parameter...

WBCE CMS vulnerable to directory traversal

Overview WBCE CMS provided by WBCE Team is an open-source Contents Management System CMS. WBCE CMS contains a directory traversal vulnerability CWE-22. ASAI Ken reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impac...

CVE-2015-1874

Cross-site request forgery CSRF vulnerability in the Contact Form DB aka CFDB and contact-form-7-to-database-extension plugin before 2.8.32 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a request in the...

WordPress JW Player 2.1.2 Cross Site Request Forgery

Details ================ Software: JW Player for Flash & HTML5 Video Version: 2.1.2 Homepage: http://wordpress.org/plugins/jw-player-plugin-for-wordpress/ Advisory ID: dxw-1970-1201 CVE: Awaiting assignment CVSS: 4.3 Medium; AV:N/AC:M/Au:N/C:N/I:N/A:P Description ================ CSRF in JW Playe...

Facebook - Delete The Admin Of Any Page Exploit

It is possible to delete the admin of any page just with a single click.This can also be converted into a bot or a worm leading to the deletion of admin of thousands of pages. It is also possible to fully automate this worm.It is very effective when we aim for wide spread attack.Targeted attacks...

ForkCMS 3.2.5 Multiple Vulnerabilities

Exploit for php platform in category web applications +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : ForkCMS 3.2.5 Multiple Vulnerabilities Author : Ivano Binetti http://ivanobinetti.com Software...