CVE-2026-85643: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used...

CVE-2024-1529: Improper Neutralization of Input During Web Page Generation

Vulnerability in CMS Made Simple 2.2.14, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting XSS vulnerability through /admin/adduser.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted JavaScript...

Cross-site Request Forgery (CSRF)

CMS Made Simple is vulnerable to cross-site request forgery CSRF attacks. A malicious user can hijack the authentication of admins for requests to create accounts through an admin/adduser.php requests...

CVE-2016-7904

CMS Made Simple CVE-2016-7904 is a CSRF in admin/adduser.php that lets an attacker hijack admin authentication to create accounts on versions before 2.1.6. Impact includes unauthorized admin account creation; remediation is to upgrade to 2.1.6 or newer.

CVE-2016-7904

Cross-site request forgery CSRF vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request...

CVE-2016-7904: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request...

CVE-2008-2348

MeltingIce File System 1.0 allows remote attackers to bypass application authentication, create new user accounts, and exceed application quotas via a direct request to admin/adduser.php...

Authentication flaw

MeltingIce File System 1.0 allows remote attackers to bypass application authentication, create new user accounts, and exceed application quotas via a direct request to admin/adduser.php...

CVE-2008-2348

MeltingIce File System 1.0 allows remote attackers to bypass application authentication, create new user accounts, and exceed application quotas via a direct request to admin/adduser.php...

CVE-2008-2348: Undefined Security Weakness

MeltingIce File System 1.0 allows remote attackers to bypass application authentication, create new user accounts, and exceed application quotas via a direct request to admin/adduser.php...

CVE-2008-2347: Improper Authentication

MyPicGallery 1.0 allows remote attackers to bypass application authentication and gain administrative access by setting the userID parameter to "admin" in a direct request to admin/addUser.php...

CVE-2007-5441: Undefined Security Weakness

CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by 1 adding a user via a direct request to admin/adduser.php and 2 reading the admin log via an...