CVE-2018-13317

Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user by making a GET request for password.htm...

CVE-2018-13317

Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user by making a GET request for password.htm...

CVE-2018-13315

Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an unauthenticated POST request...

CVE-2018-13315

Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an unauthenticated POST request...

CVE-2018-13315

Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an unauthenticated POST request...

CVE-2018-19537

TP-Link Archer C5 devices through V2160201US allow remote command execution via shell metacharacters on the wandynhostname line of a configuration file that is encrypted with the 478DA50BF9E3D2CF key and uploaded through the web GUI by using the web admin account. The default password of admin ma...

PT-2018-11738

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8 Description The issue is related to incorrect access control in the formPasswordSetup function, allowing attackers to change the admin user's password via an unauthenticated POST request to the /formPasswordSetup...

CVE-2018-19437

UCMS 1.4.7 allows remote authenticated users to change the administrator password because $COOKIE'admin'.cookiehash is used for arbitrary cookie values that are set and not empty...

Design/Logic Flaw

UCMS 1.4.7 allows remote authenticated users to change the administrator password because $COOKIE'admin'.cookiehash is used for arbitrary cookie values that are set and not empty...

CVE-2018-19367

Portainer through 1.19.2 provides an API endpoint /api/users/admin/check to verify that the admin user is already created. This API endpoint will return 404 if admin was not created and 204 if it was already created. Attackers can set an admin password in the 404 case...

PT-2018-14942

Name of the Vulnerable Software and Affected Versions Portainer versions prior to 1.19.3 Description The issue allows attackers to set an admin password under certain conditions. Specifically, it involves the API endpoint "/api/users/admin/check" which checks if the admin user is already created...

CVE-2018-19367: Undefined Security Weakness

Portainer through 1.19.2 provides an API endpoint /api/users/admin/check to verify that the admin user is already created. This API endpoint will return 404 if admin was not created and 204 if it was already created. Attackers can set an admin password in the 404 case...

Electricks eCommerce 1.0 Cross Site Request Forgery

Exploit Title: Electricks eCommerce 1.0 - Cross-Site Request Forgery Change Admin Password Date: 2018-11-12 Exploit Author: Nawaf Alkeraithe Software Link: https://www.sourcecodester.com/sites/default/files/download/billyblue/electricks.zip Version: 1.0 PoC: i?userid firstname lastname email...

Electricks eCommerce 1.0 - Cross-Site Request Forgery (Change Admin Password) Vulnerability

Exploit for php platform in category web applications Exploit Title: Electricks eCommerce 1.0 - Cross-Site Request Forgery Change Admin Password Exploit Author: Nawaf Alkeraithe Software Link: https://www.sourcecodester.com/sites/default/files/download/billyblue/electricks.zip Version: 1.0 PoC:...

Electricks eCommerce 1.0 - Cross-Site Request Forgery (Change Admin Password)

Electricks eCommerce 1.0 - Cross-Site Request Forgery Change Admin Password Exploit Title: Electricks eCommerce 1.0 - Cross-Site Request Forgery Change Admin Password Date: 2018-11-12 Exploit Author: Nawaf Alkeraithe Software Link:...

Electricks eCommerce 1.0 - Cross-Site Request Forgery (Change Admin Password)

Exploit Title: Electricks eCommerce 1.0 - Cross-Site Request Forgery Change Admin Password Date: 2018-11-12 Exploit Author: Nawaf Alkeraithe Software Link: https://www.sourcecodester.com/sites/default/files/download/billyblue/electricks.zip Version: 1.0 PoC: userid firstname lastname email...

LAOBANCMS Administrator Password Reset Vulnerability

Laoban CMS LAOBANCMS content management system is based on PHP + MYSQL environment developed by the old class of open-source website building system . LAOBANCMS 2.0 has an administrator password reset vulnerability. Attackers can use this vulnerability to reset the administrator password even if...

CVE-2018-19222

An issue was discovered in LAOBANCMS 2.0. It allows a /install/mysqlhy.php?riqi=0&i=0 attack to reset the admin password, even if install.txt exists...

Default credentials

An issue was discovered in LAOBANCMS 2.0. It allows a /install/mysqlhy.php?riqi=0&i=0 attack to reset the admin password, even if install.txt exists...

CVE-2018-19222

The CVE-2018-19222 entry concerns LAOBANCMS 2.0, where an attacker can trigger an administrator password reset via the path /install/mysql_hy.php?riqi=0&i=0, even if install.txt exists. The issue is described across multiple sources (Red Hat, CNVD, NVD, CVE listings) as a password-reset vulnerabi...