CVE-2026-88959: Missing Authorization

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...

CVE-2026-4612

A vulnerability has been found in itsourcecode Free Hotel Reservation System 1.0. This affects an unknown part of the file /hotel/admin/modusers/index.php?view=edit=8 of the component Parameter Handler. The manipulation of the argument accountid leads to sql injection. Remote exploitation of the...

CVE-2022-30829

Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\usersedit.php...

CVE-2022-30829

Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\usersedit.php...

Wedding Management System SQL注入漏洞

Wedding Management System is a wedding planning management system by John Paul Lim Gabule, a personal developer. version 1.0 of Wedding Management System is vulnerable to SQL injection, which stems from a lack of validation of external input on the admin/usersedit.php page. SQL statement...

CVE-2018-13010

WSTMall v1.9.1170316 has CSRF via the index.php?m=Admin&c=Users&a=edit URI to add a user account...

ISPConfig '/admin/users_edit.php' cross-site request forgery vulnerability

ISPConfig is a set of Linux-based open source hosting control panel, it can be used through the Web control panel to manage multiple servers, open a Web site, monitor server operating conditions and so on. ISPConfig suffers from a cross-site request forgery vulnerability that allows remote...

CVE-2012-1899: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in webfolio/admin/users/edit in Webfolio CMS 1.1.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name, 2 Last name or 3 Email required fields...

PT-2012-3637

Name of the Vulnerable Software and Affected Versions Webfolio CMS versions 1.1.4 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the First name, Last name, or Email fields in the webfolio/admin/users/edit endpoint. Recommendations For Webfolio...

CVE-2010-3026: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in application/modules/admin/controllers/users.php in Tomaz Muraus Open Blog 1.2.1, and possibly earlier, allows remote attackers to hijack the authentication of administrators for requests to admin/users/edit that grant administrative privileges...