QuickAppsCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-19557)

QuickAppsCMS aka QACMS is an open source content management system CMS developed using the MVC framework. A cross-site request forgery vulnerability exists in QuickAppsCMS 2.0.0-beta2 and earlier versions. A remote attacker can exploit this vulnerability to change the administrator password with...

Cross site request forgery (csrf)

An issue was discovered in Microweber 1.0.7. There is a CSRF attack against the admin user that can add an administrative account via api/saveuser...

Vanilla: Vanilla Forums ImportController index file_exists Unserialize Remote Code Execution Vulnerability

Summary: An authenticated admin user can inject an serialized payload into a phar archive and trigger read access to it via an unprotected fileexists. An attacker can leverage this to deserialize untrusted data and gain remote code execution. Notes: - You need to have an admin account to run this...

Improper access control

LG LNB, LND, LNU, and LNV smart network camera devices have broken access control. Attackers are able to download /updownload/t.report aka Log & Report files and download backup files via download.php without authenticating. These backup files contain user credentials and configuration informatio...

CVE-2018-16946

LG LNB, LND, LNU, and LNV smart network camera devices have broken access control. Attackers are able to download /updownload/t.report aka Log & Report files and download backup files via download.php without authenticating. These backup files contain user credentials and configuration informatio...

LG Smart IP Camera 1508190 - Backup File Download

Exploit Title: LG Smart IP Camera 1508190 - Backup File Download Date: 2018-09-11 Exploit Author: Ege Balci Vendor Homepage: https://www.lg.com Software version: 1310250 " exit0 print"==========================================================================" print" Exploit Title: LG Smart IP...

LG Smart IP Camera 1508190 File Disclosure

Exploit Title: LG Smart IP Camera 1508190 - Backup File Download Date: 2018-09-11 Exploit Author: Ege Balci Vendor Homepage: https://www.lg.com Software version: 1310250 " exit0 print"==========================================================================" print" Exploit Title: LG Smart IP...

LG Smart IP Camera 1508190 - Backup File Download

LG Smart IP Camera 1508190 - Backup File Download Exploit Title: LG Smart IP Camera 1508190 - Backup File Download Date: 2018-09-11 Exploit Author: Ege Balci Vendor Homepage: https://www.lg.com Software version: 1310250 " exit0...

CVE-2018-16431

admin/admin/adminsave.html in YFCMF v3.0 allows CSRF to add an administrator account...

CVE-2018-16431

admin/admin/adminsave.html in YFCMF v3.0 allows CSRF to add an administrator account...

PT-2018-13565 · Yfcmf · Yfcmf

Name of the Vulnerable Software and Affected Versions: YFCMF version 3.0 Description: The issue allows for Cross-Site Request Forgery CSRF attacks, enabling an attacker to add an administrator account through the admin/admin/adminsave.html endpoint. Recommendations: For YFCMF version 3.0, conside...

CVE-2018-16380

An issue was discovered in Ogma CMS 0.4 Beta. There is a CSRF vulnerability in users.php?action=createnew that can add an admin account...

Cross site request forgery (csrf)

An issue was discovered in Ogma CMS 0.4 Beta. There is a CSRF vulnerability in users.php?action=createnew that can add an admin account...

CVE-2018-16380

An issue was discovered in Ogma CMS 0.4 Beta. There is a CSRF vulnerability in users.php?action=createnew that can add an admin account...

CVE-2018-16380

CVE-2018-16380 affects Ogma CMS 0.4 Beta. A CSRF in users.php?action=createnew can be exploited to add an administrator account. According to the NVD entry, CVSSv3 base score is 8.8 (HIGH) with network attack vector, low attack complexity, no privileges required, but user interaction required, an...

Gleez CMS 1.2.0 Cross Site Request Forgery

Exploit Title: Gleez CMS 1.2.0 - Cross-Site Request Forgery Add Admin Date: 2018-08-24 Exploit Author: GunEggWang Vendor Homepage: https://gleezcms.org/ Software Link: https://github.com/gleez/cms Version: 1.2.0 CVE : CVE-2018-15845 Description: There is a CSRF vulnerability that can add an...

CVE-2018-15850

An issue was discovered in REDAXO CMS 4.7.2. There is a CSRF vulnerability that can add an administrator account via index.php?page=user...

Cross site request forgery (csrf)

There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add...

CVE-2018-15845

There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add...

CVE-2018-15845

Summary: CVE-2018-15845 is a CSRF vulnerability in Gleez CMS 1.2.0 that allows an attacker to add an administrator account via the admin/users/add endpoint. The issue is documented across multiple feeds (CVE, OSV, CNVD, GitHub advisories, Exploit DB). The root cause is a cross-site request forger...