24 matches found
CVE-2026-79411
The Webkul Bagisto 2.4.9 software is vulnerable to vertical privilege escalation due to an incorrect privilege assignment in the admin user-management component. The user-update endpoint (route admin.settings.users.update, UserController::update()) fails to verify if an actor is permitted to gran...
CVE-2026-79411: Improper Privilege Management
Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint route admin.settings.users.update, UserController::update...
EUVD-2026-75572
Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...
CVE-2026-59190
Grav plugin: grav-plugin-admin is affected. In versions ≤1.10.52, an authenticated user with admin.users permission can escalate privileges by altering another user’s password via POST to /admin/user/{username}?task=save with data[password]. The vulnerability stems from saveUser validating the ca...
PT-2026-46977
A security vulnerability has been detected in SourceCodester Ship Ferry Ticket Reservation System 1.0. Impacted is an unknown function of the file /admin/?page=user/manage user. The manipulation of the argument Username leads to cross site scripting. It is possible to initiate the attack remotely...
CVE-2025-70152: Improper Neutralization of Special Elements used in an SQL Command
code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/saveuser.php and /admin/updateuser.php. These endpoints lack authentication checks and directly concatenate user-supplied POST parameters firstname, lastname,...
CVE-2025-63218
The Axel Technology WOLF1MS and WOLF2MS devices firmware versions 0.8.5 to 1.0.3 are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and...
EUVD-2018-10450
Malware in sbrugna...
Linux Distros Unpatched Vulnerability : CVE-2022-26310
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module coul...
CVE-2022-43179
Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/?page=user/manageuser=...
Cross site request forgery (csrf)
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/user/add...
CVE-2023-3176
A vulnerability, which was classified as critical, was found in SourceCodester Lost and Found Information System 1.0. Affected is an unknown function of the file admin\user\manageuser.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. Th...
Lost and Found Information System SQL注入漏洞
Lost and Found Information System is a lost and found information system by oretnom23 individual developer. A SQL injection vulnerability exists in Lost and Found Information System version 1.0, which stems from a problem in the file adminusermanageuser.php, where incorrect manipulation of the...
PT-2023-23453 · Sourcecodester · Sourcecodester Lost/Found Information System
Name of the Vulnerable Software and Affected Versions: SourceCodester Lost and Found Information System version 1.0 Description: A critical issue was found in the SourceCodester Lost and Found Information System. The problem affects an unknown function of the file adminusermanage user.php. The...
PT-2023-23362
Name of the Vulnerable Software and Affected Versions SourceCodester Online Discussion Forum Site version 1.0 Description A critical issue has been discovered, allowing for SQL injection through the manipulation of the id argument in an unknown function of the file adminusermanage user.php. This...
Online Thesis Archiving System SQL注入漏洞
Online Thesis Archiving System is an online thesis archiving system. Online Thesis Archiving System version 1.0 has a sql injection vulnerability, which originates from the poor filtering of the id parameter in /admin/user/manageuser.php. An attacker can use this vulnerability to perform SQL...
CVE-2023-1740
A vulnerability was found in SourceCodester Air Cargo Management System 1.0. It has been classified as critical. Affected is an unknown function of the file admin/user/manageuser.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible...
Automotive Shop Management System SQL注入漏洞
Automotive Shop Management System is an automotive shop management system by the individual developer Carlo Montero. Automotive Shop Management System v1.0 suffers from a SQL injection vulnerability that originates from /asms/admin/?page=user/manageuser&id=Lack of validation of externally entered...
