2605 matches found
CVE-2022-30898
A Cross-site request forgery CSRF vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password...
Account takeover due to stored XSS in "Project Title"
Description The Project "Title" of the NocoDB application is vulnerable to stored xss which can leads to admin account takeover. Proof of Concept Login with low privileged users and Click on "New Project" then click on "Create" Now write the payload and again click on "Create" Then login from sup...
Authentication flaw
A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account when an attacker hijacks a session. Affected Products: Wiser Smart, EER21000 & EER21001 V4.5 and prior...
CVE-2022-30238
A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account when an attacker hijacks a session. Affected Products: Wiser Smart, EER21000 & EER21001 V4.5 and prior...
CVE-2022-29647
An issue was discovered in MCMS 5.2.7. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do...
CVE-2022-29647
MCMS 5.2.7 is affected by a Cross-Site Request Forgery (CSRF) vulnerability that enables an attacker to add an administrator account via the path ms/basic/manager/save.do. Public sources in the connected set consistently describe this flaw in MingSoft MCMS and detail the injection vector through ...
qdPM 9.1 - Remote Code Execution (Authenticated) Exploit
Exploit Title: qdPM 9.1 - Remote Code Execution RCE Authenticated Google Dork: intitle:qdPM 9.1. Copyright © 2020 qdpm.net Original Exploit Author: Rishal Dwivedi Loginsoft Original ExploitDB ID: 47954 https://www.exploit-db.com/exploits/47954 Exploit Author: Leon Trappett thepcn3rd Vendor...
EC-CUBE Cross-site request forgery (CSRF) vulnerability
Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...
GHSA-842M-VP3R-QWWR ThinkCMF Cross Site Request Forgerly (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability in ThinkCMF, which can add an admin account...
ThinkCMF Cross Site Request Forgerly (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability in ThinkCMF, which can add an admin account...
Dolibarr stored Cross-site Scripting vulnerability
In Dolibarr 10.0.6, if USERLOGINFAILED is active, there is a stored XSS vulnerability on the admin tools -- audit page. This may lead to stealing of the admin account...
GHSA-Q938-82FW-WFCF Dolibarr stored Cross-site Scripting vulnerability
In Dolibarr 10.0.6, if USERLOGINFAILED is active, there is a stored XSS vulnerability on the admin tools -- audit page. This may lead to stealing of the admin account...
GHSA-4QQ9-QG7J-FCM9 Dolibarr Cross-Site Request Forgery (CSRF)
An issue was discovered in Dolibarr. A user can store an IFRAME element containing a user/card.php CSRF request in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. The protection mechanism for CSRF is to check the Referer header; howeve...
Dolibarr Cross-Site Request Forgery (CSRF)
An issue was discovered in Dolibarr. A user can store an IFRAME element containing a user/card.php CSRF request in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. The protection mechanism for CSRF is to check the Referer header; howeve...
CVE-2022-29002
CVE-2022-29002 affects XXL-Job v2.3.0, where CSRF in the /gaia-job-admin/user/add component allows an attacker to arbitrarily create administrator accounts. The linked sources (CNVD/OSV/GHSA/Red Hat/OSV) consistently describe lack of filtering/restrictions in that endpoint as the root cause. No r...
Cross site scripting
Rescue Dispatch Management System 1.0 suffers from Stored XSS, leading to admin account takeover via cookie stealing...
CVE-2022-30017
Rescue Dispatch Management System 1.0 suffers from Stored XSS, leading to admin account takeover via cookie stealing...
CVE-2022-30017
Rescue Dispatch Management System 1.0 suffers from Stored XSS, leading to admin account takeover via cookie stealing...
CVE-2022-30017
The CVE-2022-30017 entry concerns Rescue Dispatch Management System 1.0, affected by a Stored XSS vulnerability in which attacker-supplied script can be stored and executed, enabling cookie theft and potential admin account takeover. Multiple connected sources corroborate that the flaw is a cross...