Cross site request forgery (csrf)

ClinicCases 7.3.3 is affected by Cross-Site Request Forgery CSRF. A successful attack would consist of an authenticated user following a malicious link, resulting in arbitrary actions being carried out with the privilege level of the targeted user. This can be exploited to create a secondary...

CVE-2021-38705

ClinicCases 7.3.3 is affected by Cross-Site Request Forgery CSRF. A successful attack would consist of an authenticated user following a malicious link, resulting in arbitrary actions being carried out with the privilege level of the targeted user. This can be exploited to create a secondary...

Protect

An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS CLI may allow a local and authenticated user assigned to a specific VDOM to retrieve other VDOMs information such as the admin account list and the network interface list. Â...

SURMS - PHP (by: oretnom23 ) v1.0 SQL-Injection-Bypass-Authentication and PWNED PHPSESSID Hijacking

The SURMS – PHP by: oretnom23 v1.0 is vulnerable from remote SQL-Injection-Bypass-Authentication for the admin account and PWNED PHPSESSID Hijacking in app /storage/classes/Login.php. remote SQL-Injection-Bypass-Authentication: . The parameter username from the login form is not protected correct...

Online Leave Management System 1.0 SQL Injection

Exploit Title: OLMS - PHP by: oretnom23 v1.0 SQL-Injection-Bypass-Authentication in /leavesystem/classes/Login.php. Author: nu11secur1ty Testing and Debugging: nu11secur1ty Date: 08.31.2021 Vendor: https://www.sourcecodester.com/php/14910/online-leave-management-system-php-free-source-code.html...

GHSA-CPV8-6XGR-RMF6 Dolibarr Cross-site Scripting vulnerability

In Dolibarr ERP CRM, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the Private Note field at /adherents/note.php?id=1 endpoint. These scripts are executed in a victim’s browser when th...

CVE-2020-18123

The CVE-2020-18123 entries describe a CSRF vulnerability in Indexhibit 2.1.5 that allows an attacker to arbitrarily delete administrator accounts. Affected software: Indexhibit 2.1.5 (web-based CMS). Underlying issue: cross-site request forgery enabling unauthorized admin deletion. Impact: admini...

CVE-2020-18123

A cross-site request forgery CSRF vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily delete admin accounts...

Design/Logic Flaw

Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTT...

PT-2021-19656 · Solarwinds · Solarwinds Web Help Desk

Name of the Vulnerable Software and Affected Versions: SolarWinds Web Help Desk version 12.7.2 Description: A security issue was discovered, allowing access restriction bypass via referrer spoof. An attacker can access the "Web Help Desk Getting Started Wizard", specifically the admin account...

CVE-2020-19669

Cross Site Request Forgery CSRF vulnerability exists in Eyoucms 1.3.6 that can add an admin account via /login.php?m=admin&c=Admin&a=adminadd&lang=cn...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability exists in Eyoucms 1.3.6 that can add an admin account via /login.php?m=admin&c=Admin&a=adminadd&lang=cn...

CVE-2020-19669

Cross Site Request Forgery CSRF vulnerability exists in Eyoucms 1.3.6 that can add an admin account via /login.php?m=admin&c=Admin&a=adminadd&lang=cn...

CVE-2020-19669

CVE-2020-19669 is a CSRF vulnerability in EyouCMS 1.3.6 that allows an attacker to add an admin account via crafted requests to login.php?m=admin&c=Admin&a=admin_add&lang=cn. Affected software: EyouCMS 1.3.6. Root cause: insufficient verification of that requests come from trusted users. Impact: ...

CVE-2020-28846

Cross Site Request Forgery CSRF vulnerability exists in SeaCMS 10.7 in adminmanager.php, which could let a malicious user add an admin account...

CVE-2020-28846

Cross Site Request Forgery CSRF vulnerability exists in SeaCMS 10.7 in adminmanager.php, which could let a malicious user add an admin account...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability exists in SeaCMS 10.7 in adminmanager.php, which could let a malicious user add an admin account...

CVE-2020-28846

Cross Site Request Forgery CSRF vulnerability exists in SeaCMS 10.7 in adminmanager.php, which could let a malicious user add an admin account...

CVE-2021-25955

In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the “Private Note” field at “/adherents/note.php?id=1” endpoint. These scripts are executed in a victim’s browser...

Improper access control

In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the “Private Note” field at “/adherents/note.php?id=1” endpoint. These scripts are executed in a victim’s browser...