Design/Logic Flaw

An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add an admin account via admin.php?m=Admin&c=manager&a=add...

CVE-2018-14068

SRCMS V2.3.1 is affected by a CSRF vulnerability that can add an administrator account via the endpoint admin.php?m=Admin&c=manager&a=add. This exposes the admin creation function to CSRF, enabling potential unauthorized admin access. The issue is confirmed across multiple sources (CVE-2018-14068...

CVE-2018-14068

An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add an admin account via admin.php?m=Admin&c=manager&a=add...

CVE-2018-14014

In waimai Super Cms 20150505, there is a CSRF vulnerability that can add an admin account via admin.php?m=Member&a=adminadd...

Cross site request forgery (csrf)

In waimai Super Cms 20150505, there is a CSRF vulnerability that can add an admin account via admin.php?m=Member&a=adminadd...

CVE-2018-14014

In waimai Super Cms 20150505, there is a CSRF vulnerability that can add an admin account via admin.php?m=Member&a=adminadd...

CVE-2018-14014

CVE-2018-14014 affects waimai Super Cms 20150505 and involves a Cross-Site Request Forgery (CSRF) vulnerability in admin.php?m=Member&a=adminadd that can be exploited to add an administrator account. The Red Hat, CNVD, CVE registries and others corroborate a CSRF issue in this CMS, with consisten...

CVE-2018-13444

An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add an admin account via adm1n/adminmanager.php?action=save&id=2...

CVE-2018-13444

CVE-2018-13444 affects SeaCMS 6.61. The issue is a cross-site request forgery (CSRF) that can add an administrator account via the URL adm1n/admin_manager.php?action=save&id=2. The connected documents confirm the vulnerability exists in SeaCMS 6.61 and describe the admin-adding vector, but there ...

CVE-2018-13444

An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add an admin account via adm1n/adminmanager.php?action=save&id=2...

Remote code execution

An issue was discovered on Dongguan Diqee Diqee360 devices. The affected vacuum cleaner suffers from an authenticated remote code execution vulnerability. An authenticated attacker can send a specially crafted UDP packet, and execute commands on the vacuum cleaner as root. The bug is in the...

Cross site request forgery (csrf)

DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account...

CVE-2018-13031

DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account...

CVE-2018-10987

CVE-2018-10987 is a remote code execution flaw in the Dongguan Diqee 360 vacuum cleaners. The vulnerability resides in the UDP command 153, REQUEST_SET_WIFIPASSWD, where a crafted UDP packet can cause the device to execute a command as root ("/mnt/skyeye/mode_switch.sh %s"). An attacker must auth...

CVE-2018-13040

OpenSID 18.06-pasca has a CSRF vulnerability. This vulnerability can add an account at the admin level via the index.php/manuser/insert URI...

CVE-2018-1000509

Redirection version 2.7.1 contains a Serialisation vulnerability possibly allowing ACE vulnerability in Settings page AJAX that can result in could allow admin to execute arbitrary code in some circumstances. This attack appear to be exploitable via Attacker must have access to admin account. Thi...

CVE-2018-1000509

Redirection version 2.7.1 contains a Serialisation vulnerability possibly allowing ACE vulnerability in Settings page AJAX that can result in could allow admin to execute arbitrary code in some circumstances. This attack appear to be exploitable via Attacker must have access to admin account. Thi...

Design/Logic Flaw

Redirection version 2.7.1 contains a Serialisation vulnerability possibly allowing ACE vulnerability in Settings page AJAX that can result in could allow admin to execute arbitrary code in some circumstances. This attack appear to be exploitable via Attacker must have access to admin account. Thi...

CVE-2018-1000504

Redirection version 2.7.3 contains a ACE via file inclusion vulnerability in Pass-through mode that can result in allows admins to execute any PHP file in the filesystem. This attack appear to be exploitable via Attacker must be have access to an admin account on the target site. This vulnerabili...

CVE-2018-1000509

CVE-2018-1000509 affects the WordPress Redirection plugin, specifically version 2.7.1 . The vulnerability is a serialization issue in the plugin’s Settings page AJAX, which in certain circumstances can let an attacker with an admin account execute arbitrary code. The flaw is resolved in version 2...