CVE-2019-10687

KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entryid0 parameter, the admin/index.php?module=log id parameter, or an index.php?View=print&id= request...

CVE-2019-1934

A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance ASA Software could allow an authenticated, remote attacker to elevate privileges and execute administrative functions on an affected device. The vulnerability is due to insufficient authorization validation...

CVE-2018-19515

In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator. However, by using one of the bgsend, atmentsddd1xGz, or xlsbgimport query parameters, most of these methods become available to unauthenticated users...

Castlamp Zenbership Cross-Site Request Forgery Vulnerability

Castlamp Zenbership is an open source and free membership CRM software from Castlamp USA. The software is capable of providing a specialized customer relationship management system for membership sites. A cross-site request forgery vulnerability exists in Castlamp Zenbership version 107, which ca...

PT-2018-15030

Name of the Vulnerable Software and Affected Versions Interspire Email Marketer versions prior to 6.1.7 Description The issue allows for Server Side Request Forgery SSRF via a "what=importurl&url=" request with an http or https URL to the "admin/functions/remote.php" endpoint. This also enables...

U.S. Dept Of Defense: Default page exposes admin functions and all metods and classes available. on https://██████/█████/dwr/index.html

Summary: https://████/██████/dwr/index.html is a default installation page of DWR engine that exposes all classes and methods available to the user. Description: https://█████████/██████████/dwr/index.html is a default installation page of DWR engine that exposes all classes and methods available...

SeaWell Networks Spectrum - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: SeaWell Networks Spectrum - Multiple Vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: http://www.seawellnetworks.com/spectrum/ Versions Reported: Spectrum SDC 02.05.00, Build 02.05.00.0016 CVE-ID: CVE-2015-8282...

Simple Fields 1.1.6 - Admin Functions CSRF

The Simple Fields WordPress plugin was affected by an Admin Functions CSRF security vulnerability...

CVE-2012-1498

Multiple cross-site request forgery CSRF vulnerabilities in Webfolio CMS 1.1.4 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 add an administrator via an add action to admin/users/add or 2 modify a web page via a save action to...

[eVuln.com] Cookie authentication bypass in Alguest

New eVuln Advisory: Cookie authentication bypass in Alguest Summary: http://evuln.com/vulns/152/summary.html Details: http://evuln.com/vulns/152/description.html -----------Summary----------- eVuln ID: EV0152 Software: Alguest Vendor: n/a Version: 1.1c-patched Critical Level: high Type:...

CVE-2009-2161

Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic 1.09, when used on a case-insensitive web site, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the ssuri parameter, in conjunction with a modified component name...

Design/Logic Flaw

RSS-aggregator 1.0 does not require administrative authentication for the admin/fonctions/ directory, which allows remote attackers to access admin functions and have unspecified other impact, as demonstrated by 1 an IdFlux request to supprimerflux.php and 2 a TpsRafraich request to...

CVE-2008-3033

RSS-aggregator 1.0 does not require administrative authentication for the admin/fonctions/ directory, which allows remote attackers to access admin functions and have unspecified other impact, as demonstrated by 1 an IdFlux request to supprimerflux.php and 2 a TpsRafraich request to...

CVE-2008-3033

CVE-2008-3033 concerns RSS-aggregator 1.0 where the admin/fonctions/ directory does not require administrative authentication. This allows remote attackers to access admin functions (e.g., supprimer_flux.php and modifier_tps_rafraich.php) with unspecified additional impact. The provided documents...

CVE-2008-3033: Improper Authentication

RSS-aggregator 1.0 does not require administrative authentication for the admin/fonctions/ directory, which allows remote attackers to access admin functions and have unspecified other impact, as demonstrated by 1 an IdFlux request to supprimerflux.php and 2 a TpsRafraich request to...

RSS-aggregator Multiple vulnerabilities

---------------- RSS-aggregator ---------------- Informations : Langage : PHP Version : 1.0 Website : http://www.rss-aggregator.com Problems : Multiple vulnerabilities Description: RSS-aggregator is a tool, for Webmaster, allowing to display several feeds RSS on a single page. Details :...

rssagg-sql.txt

---------------- RSS-aggregator ---------------- Informations : Langage : PHP Version : 1.0 Website : http://www.rss-aggregator.com Problems : Multiple vulnerabilities Description: RSS-aggregator is a tool, for Webmaster, allowing to display several feeds RSS on a single page. Details :...

phpBB 2.0.23 Session Hijacking Vulnerability

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ phpBB 2.0.23 Session Hijacking Vulnerability + found by NBBN 13 Mar 2008 + +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ::Information about this vulnerabilty If a moderator or an admin close a thread in phpBB 2.0.X, th...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Lama Software allow remote attackers to execute arbitrary PHP code via a URL in the MYCONFclassRoot parameter to 1 inc.steps.accesserror.php, 2 inc.steps.checklogin.php, or 3 inc.steps.initsystem.php in admin/functions/...

CVE-2008-0423

Multiple PHP remote file inclusion vulnerabilities in Lama Software allow remote attackers to execute arbitrary PHP code via a URL in the MYCONFclassRoot parameter to 1 inc.steps.accesserror.php, 2 inc.steps.checklogin.php, or 3 inc.steps.initsystem.php in admin/functions/...