2758 matches found
CVE-2018-17881
On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger an admin password change...
CVE-2018-17103
An issue was discovered in GetSimple CMS v3.3.13. There is a CSRF vulnerability that can change the administrator's password via admin/settings.php. NOTE: The vendor reported that the PoC was sending a value for the nonce parameter...
CVE-2018-17103
GetSimple CMS v3.3.13 is affected by a CSRF vulnerability that can change the administrator password via admin/settings.php. The issue is evidenced in multiple sources (NVD/CVE-2018-17103, CNVD-2018-19747, OSV, CVE records). The root cause is a CSRF flaw possibly related to nonce handling, enabli...
CVE-2018-17102
CVE-2018-17102 affects QuickAppsCMS (QACMS) up to version 2.0.0-beta2. The issue is a Cross-Site Request Forgery (CSRF) vulnerability that can change the administrator password via the /user/me URI. Documented impact indicates high-severity outcomes (e.g., unauthorized password change) with netwo...
PT-2018-13897 · Getsimple · Getsimple Cms
Name of the Vulnerable Software and Affected Versions: GetSimple CMS version 3.3.13 Description: An issue was discovered that allows for a CSRF vulnerability, which can change the administrator's password via the "admin/settings.php" endpoint. The vendor reported that the proof of concept was...
CVE-2018-17045
CMS MaeloStore V1.5.0 contains a CSRF vulnerability that can change the administrator password via the endpoint admin/modul/users/aksi_users.php?act=update. Affected software: MaeloStore CMS (V1.5.0). Root cause: improper CSRF protections allowing an attacker to trigger a password change. Impact:...
Monstra CMS Insecure Direct Object Reference Vulnerability
Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. An insecure direct object reference vulnerability exists in Monstra CMS version 3.0.4, which can be exploited...
Design/Logic Flaw
In Monstra CMS 3.0.4, an attacker with 'Editor' privileges can change the password of the administrator via an admin/index.php?id=users&action=edit&userid=1, Insecure Direct Object Reference IDOR...
LinkNet LW-N605R 12.20.2.1486 - Remote Code Execution Exploit
Exploit for hardware platform in category web applications Title: LW-N605R 12.20.2.1486 - Remote Code Execution Author: Nassim Asrir Vendor: LINK-NET Product Link: http://linknet-usa.com/main/productinfo.php?productsid=35&language=es Firmware version: 12.20.2.1486 CVE: N/A Description: LW-N605R...
DamiCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-19082)
DamiCMS is a content management system CMS for building websites quickly. A cross-site request forgery vulnerability exists in the admin.php?s=/Admin/doedit URL in DamiCMS version 6.0.0, which can be exploited by a remote attacker to change the password of an administrator account...
AuraCMS Cross-Site Request Forgery Vulnerability
AuraCMS is a content management system based on PHP and MySQL. The system is characterized by simplicity and modularity. AuraCMS 2.3 version of the cross-site request forgery vulnerability , remote attackers can use admin.php?mod=users to modify the administrator password , and then add pages or...
EasyCMS Cross-Site Request Forgery Vulnerability
EasyCMS is a scalable lightweight open source content management system CMS written in PHP. Cross-site request forgery vulnerability exists in EasyCMS version 1.5, which can be exploited by remote attackers to add a regular user and update the administrator password with the help of...
CVE-2018-16345
An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...
CVE-2018-16345
An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...
Cross site request forgery (csrf)
An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via admin.php?mod=users and subsequently add a page or menu, or submit a topic...
Cross site request forgery (csrf)
An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...
CVE-2018-16338
An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via admin.php?mod=users and subsequently add a page or menu, or submit a topic...
CVE-2018-16338
AuraCMS 2.3 is affected by a CSRF vulnerability that can change the administrator password via admin.php?mod=users, and this may enable the attacker to subsequently add a page or menu or submit a topic. The connected documents corroborate the same issue across multiple sources (NVD, CNVD, PRION, ...