CVE-2021-30224

Cross Site Request Forgery CSRF in Rukovoditel v2.8.3 allows attackers to create an admin user with an arbitrary credentials...

Rukovoditel 跨站请求伪造漏洞

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . Rukovoditel v2.8.3 version of the cross-site request forgery vulnerability , the vulnerability stems fr...

CVE-2021-30165

CVE-2021-30165 affects EDIMAX wireless network cameras (e.g., IC-3140W) where the default administrator account and password are hard-coded. The root cause is a hard-coded credential that enables remote attackers to disassemble firmware and obtain privileged permissions, allowing potential full c...

BlackCat CMS 1.3.6 - (Multiple) Stored Cross-Site Scripting (XSS) Vulnerability

Exploit Title: BlackCat CMS 1.3.6 - 'Multiple' Stored Cross-Site Scripting XSS Exploit Author: Ömer Hasan Durmuş Vendor Homepage: https://blackcat-cms.org/ Software Link: https://blackcat-cms.org/page/download.php Version: BlackCat CMS - 1.3.6 Step 1 : Login to admin account in...

BlackCat CMS 1.3.6 - 'Multiple' Stored Cross-Site Scripting (XSS)

Exploit Title: BlackCat CMS 1.3.6 - 'Multiple' Stored Cross-Site Scripting XSS Date: 04/07/2021 Exploit Author: Ömer Hasan Durmuş Vendor Homepage: https://blackcat-cms.org/ Software Link: https://blackcat-cms.org/page/download.php Version: BlackCat CMS - 1.3.6 Step 1 : Login to admin account in...

Glovo: Moodle XSS on evolve.glovoapp.com

Cross Site Scripting XSS / Moodle XSS Summary : Cross-site scripting XSS is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by...

Cross-site Request Forgery (CSRF)

trestle-auth is vulnerable to cross-site request forgery. An attacker is able to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session, allowing to alter protected data, including admin account credentials...

Cross-Site Request Forgery (CSRF) in trestle-auth

Impact A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account...

CVE-2021-29435

trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially...

Design/Logic Flaw

trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially...

GHSA-H8HX-2C5R-32CF Cross-Site Request Forgery (CSRF) in trestle-auth

Impact A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account...

CVE-2021-29435 Cross-Site Request Forgery (CSRF) in trestle-auth

trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially...

CVE-2021-20021

A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host...

CVE-2021-20021

CVE-2021-20021 affects SonicWall Email Security. The vulnerability enables an unauthenticated attacker to create an administrative account via a crafted HTTP request to the ES appliance, by exploiting an improperly secured admin API endpoint. This leads to privilege escalation with administrator ...

CVE-2021-24175

The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user including admin by just providing the related username, as well as create accounts with...

PT-2021-15721

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor Page Builder WordPress plugin versions prior to 4.1.7 Description: The issue allows malicious actors to bypass authentication, enabling unauthenticated users to log in as any user, including admin, by providing t...

CVE-2021-29663

CourseMS aka Course Registration Management System 2.1 is affected by cross-site scripting XSS. When an attacker with access to an Admin account creates a Job Title in the Site area aka the admin/addjobs.php name parameter, they can insert an XSS payload. This payload will execute whenever anyone...

CVE-2021-29663

CourseMS aka Course Registration Management System 2.1 is affected by cross-site scripting XSS. When an attacker with access to an Admin account creates a Job Title in the Site area aka the admin/addjobs.php name parameter, they can insert an XSS payload. This payload will execute whenever anyone...

Cross site scripting

CourseMS aka Course Registration Management System 2.1 is affected by cross-site scripting XSS. When an attacker with access to an Admin account creates a Job Title in the Site area aka the admin/addjobs.php name parameter, they can insert an XSS payload. This payload will execute whenever anyone...

CVE-2021-29663

CourseMS aka Course Registration Management System 2.1 is affected by cross-site scripting XSS. When an attacker with access to an Admin account creates a Job Title in the Site area aka the admin/addjobs.php name parameter, they can insert an XSS payload. This payload will execute whenever anyone...