51 matches found
CVE-2020-13827
phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php...
CVE-2019-12094
Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...
Hardcoded credentials
Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...
CVE-2019-12094
Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...
CVE-2019-12094
Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...
CVE-2019-12094
Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...
CVE-2019-12094
CVE-2019-12094 affects Horde Groupware Webmail Edition through 5.2.22. The vulnerability allows XSS via crafted URIs such as admin/user.php?form=update_f&user_name=, admin/user.php?form=remove_f&user_name=, or admin/config/diff.php?app=, as documented in the CVE entry and OSV/NVD references. The ...
PT-2019-12636
Name of the Vulnerable Software and Affected Versions Horde Groupware Webmail Edition versions prior to 5.2.23 Description The issue allows for XSS attacks via specific URI parameters. This can be achieved through the admin/user.php endpoint with either the form=update f or form=remove f paramete...
CVE-2019-12094: Improper Neutralization of Input During Web Page Generation
Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...
CVE-2019-9594
BlueCMS 1.6 allows SQL Injection via the userid parameter in an uploads/admin/user.php?act=edit request...
CVE-2019-9594
CVE-2019-9594 affects BlueCMS 1.6 and describes an SQL injection vulnerability in the parameter user_id within the uploads/admin/user.php?act=edit request. The vulnerability allows bypassing authentication and manipulating the SQL queries executed by the application, leading to potential disclosu...
PT-2019-19734
Name of the Vulnerable Software and Affected Versions BlueCMS version 1.6 Description The issue allows SQL Injection via the user id parameter in a "uploads/admin/user.php?act=edit" request. Recommendations For BlueCMS version 1.6, consider restricting access to the...
CVE-2019-9594: Improper Neutralization of Special Elements used in an SQL Command
BlueCMS 1.6 allows SQL Injection via the userid parameter in an uploads/admin/user.php?act=edit request...
CVE-2019-6126: Direct Request
The Admin Panel of PHP Scripts Mall Advance Peer to Peer MLM Script v1.7.0 allows remote attackers to bypass intended access restrictions by directly navigating to admin/dashboard.php or admin/user.php, as demonstrated by disclosure of information about users and staff...
PT-2019-17966
Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Advance Peer to Peer MLM Script version 1.7.0 Description The issue allows remote attackers to bypass intended access restrictions. This can be achieved by directly navigating to "admin/dashboard.php" or "admin/user.php",...
CVE-2018-18316
emlog v6.0.0 has CSRF via the admin/user.php?action=new URI...
CVE-2018-18316
emlog v6.0.0 has CSRF via the admin/user.php?action=new URI...
Cross site request forgery (csrf)
emlog v6.0.0 has CSRF via the admin/user.php?action=new URI...