CVE-2018-17102

CVE-2018-17102 affects QuickAppsCMS (QACMS) up to version 2.0.0-beta2. The issue is a Cross-Site Request Forgery (CSRF) vulnerability that can change the administrator password via the /user/me URI. Documented impact indicates high-severity outcomes (e.g., unauthorized password change) with netwo...

PT-2018-13897 · Getsimple · Getsimple Cms

Name of the Vulnerable Software and Affected Versions: GetSimple CMS version 3.3.13 Description: An issue was discovered that allows for a CSRF vulnerability, which can change the administrator's password via the "admin/settings.php" endpoint. The vendor reported that the proof of concept was...

CVE-2018-17045

CMS MaeloStore V1.5.0 contains a CSRF vulnerability that can change the administrator password via the endpoint admin/modul/users/aksi_users.php?act=update. Affected software: MaeloStore CMS (V1.5.0). Root cause: improper CSRF protections allowing an attacker to trigger a password change. Impact:...

Monstra CMS Insecure Direct Object Reference Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. An insecure direct object reference vulnerability exists in Monstra CMS version 3.0.4, which can be exploited...

Design/Logic Flaw

In Monstra CMS 3.0.4, an attacker with 'Editor' privileges can change the password of the administrator via an admin/index.php?id=users&action=edit&userid=1, Insecure Direct Object Reference IDOR...

LinkNet LW-N605R 12.20.2.1486 - Remote Code Execution Exploit

Exploit for hardware platform in category web applications Title: LW-N605R 12.20.2.1486 - Remote Code Execution Author: Nassim Asrir Vendor: LINK-NET Product Link: http://linknet-usa.com/main/productinfo.php?productsid=35&language=es Firmware version: 12.20.2.1486 CVE: N/A Description: LW-N605R...

AuraCMS Cross-Site Request Forgery Vulnerability

AuraCMS is a content management system based on PHP and MySQL. The system is characterized by simplicity and modularity. AuraCMS 2.3 version of the cross-site request forgery vulnerability , remote attackers can use admin.php?mod=users to modify the administrator password , and then add pages or...

DamiCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-19082)

DamiCMS is a content management system CMS for building websites quickly. A cross-site request forgery vulnerability exists in the admin.php?s=/Admin/doedit URL in DamiCMS version 6.0.0, which can be exploited by a remote attacker to change the password of an administrator account...

EasyCMS Cross-Site Request Forgery Vulnerability

EasyCMS is a scalable lightweight open source content management system CMS written in PHP. Cross-site request forgery vulnerability exists in EasyCMS version 1.5, which can be exploited by remote attackers to add a regular user and update the administrator password with the help of...

CVE-2018-16345

An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...

CVE-2018-16345

An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...

Cross site request forgery (csrf)

An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...

Cross site request forgery (csrf)

An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via admin.php?mod=users and subsequently add a page or menu, or submit a topic...

CVE-2018-16338

An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via admin.php?mod=users and subsequently add a page or menu, or submit a topic...

CVE-2018-16338

AuraCMS 2.3 is affected by a CSRF vulnerability that can change the administrator password via admin.php?mod=users, and this may enable the attacker to subsequently add a page or menu or submit a topic. The connected documents corroborate the same issue across multiple sources (NVD, CNVD, PRION, ...

CVE-2018-16331

admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password...

DamiCMS 6.0.0 - Cross-Site Request Forgery (Change Admin Password) Vulnerability

Exploit for php platform in category web applications 0day.today 2018-09-01...

DamiCMS 6.0.0 - Cross-Site Request Forgery (Change Admin Password)

DamiCMS 6.0.0 - Cross-Site Request Forgery Change Admin Password Exploit Title: DamiCMS 6.0.0 - Cross-Site Request Forgery Change Admin Password Author: AutismJH Date: 2018-08-30 Vendor Homepage: https://github.com/731276192/damicms Software Link: https://github.com/731276192/damicms Version: 6.0...

DamiCMS 6.0.0 - Cross-Site Request Forgery (Change Admin Password)

Exploit Title: DamiCMS 6.0.0 - Cross-Site Request Forgery Change Admin Password Author: AutismJH Date: 2018-08-30 Vendor Homepage: https://github.com/731276192/damicms Software Link: https://github.com/731276192/damicms Version: 6.0.0 CVE: CVE-2018-15844 Description: DamiCMS v6.0.0 allows CSRF to...

D-Link DIR-601 Elevation of Privilege Vulnerability

D-Link DIR-601 is a wireless router product from AUO D-Link. A security vulnerability exists in the D-Link DIR-601 version 2.02NA, which originates from the inclusion of an administrator password in XML. A local attacker can exploit this vulnerability by hijacking the response to a POST request t...