Privilege Escalation

express-cart is vulnerable to privilege escalation attacks. A malicious user can pass a crafted request to the endpoint containing the /admin/setup string to create a user that will be considered as an admin user...

Cross site request forgery (csrf)

CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account, as demonstrated by modifying the account's email field...

CVE-2018-14029

CVE-2018-14029 : CSRF in the WityCMS 0.6.2 admin/user/edit flow allows an attacker to take over a user account by modifying user data (e.g., email, password). The vulnerability stems from cross-site request forgery in the admin interface, with CVSSv3 base score 8.8 (HIGH) and user interaction req...

CVE-2018-11447

CVE-2018-11447 affects Siemens SCALANCE M875 devices. The vulnerability is a CSRF flaw in the web interface (port 443/tcp) that can allow an authenticated administrative user to interact with the interface as an administrative user when a user is lured to a malicious link. Impact described includ...

Udemy: [affiliates.udemy.com] Wordpress user admin information discloure

Summary This website using Wordpress CMS, so developer forget to disable the link that can view information of admin user. By access to this link, attacker can get all username and other information of user admin: http://affiliates.udemy.com/wp-json/wp/v2/users F312155 Admin user list: hamza...

Intex Router N-150 - Cross-Site Request Forgery (Add Admin)

Exploit Title: Intex Router N-150 - Cross-Site Request Forgery Add Admin Date: 2018-06-23 Exploit Author: Navina Asrani Version: N-150 CVE : N/A Category: Router Firmware 1. Description The firmware allows malicious request to be executed without verifying source of request. This leads to arbitra...

Intex Router N-150 Cross Site Request Forgery

Exploit Title:aa Intex Router N-150 - Cross-Site Request Forgery Add Admin Date: 2018-06-23 Exploit Author: Navina Asrani Version: N-150 CVE : N/A Category: Router Firmware 1. Description The firmware allows malicious request to be executed without verifying source of request. This leads to...

Intex Router N-150 - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for hardware platform in category web applications Exploit Title:​​ Intex Router N-150 - Cross-Site Request Forgery Add Admin Exploit Author: Navina Asrani Version: N-150 Category: Router Firmware 1. Description The firmware allows malicious request to be executed without verifying source...

Unspecified Vulnerability in expressCart

expressCart is a shopping cart module used in Node.js. A security vulnerability exists in expressCart. A remote attacker can exploit this vulnerability to create an admin user...

CVE-2018-12457

expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header...

CVE-2018-12457

expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header...

Design/Logic Flaw

expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header...

CVE-2018-12457

expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header...

CVE-2018-12457

CVE-2018-12457 affects Express-Cart up to version 1.1.6. A remote attacker can create an admin user by exploiting a Referer header to /admin/setup, enabling unauthorized admin account creation. Descriptions across multiple sources confirm the same issue; no explicit exploit details beyond the hea...

Synology Photo Station Cross-Site Request Forgery Vulnerability

Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. A cross-site request forgery vulnerability exists in the admin/user.php file in Synology Photo Station versions prior to 6.8.5-3471 and prior to 6.3-2975. A remote attacker can exploit the...

Scubez Posty Readymade Classifieds SQL Injection Vulnerability

Posty Scubez Posty Readymade Classifieds is a suite of announcement-based website scripts from Posty India. A SQL injection vulnerability exists in Posty Scubez Posty Readymade Classifieds. A remote attacker can exploit this vulnerability by sending the 'ID' parameter to the...

CVE-2018-11632

An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker via spear phishing/social engineering, the attacker can change the plugin settings via...

Cross site request forgery (csrf)

An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker via spear phishing/social engineering, the attacker can change the plugin settings. The function...

PES Pro 1.9.7 Authentication Bypass

==================================================================================================================================== | Title : PES Pro - v1.9.7 Reinstall add admin Vulnerability | | Author : indoushka | | Telegram : @indoushka | | Tested on : windows 10 FranASSais V.Pro | | Vendor...

EMC RecoverPoint 4.3 - Admin CLI Command Injection Vulnerability

Exploit for windows platform in category local exploits Exploit Title: EMC RecoverPoint 4.3 - Admin CLI Command Injection Version: RecoverPoint prior to 5.1.1 RecoverPoint for VMs prior to 5.0.1.3 Date: 2018-05-11 Exploit Author: Paul Taylor Github: https://github.com/bao7uo Tested on: RecoverPoi...