CVE-2018-19222

The CVE-2018-19222 entry concerns LAOBANCMS 2.0, where an attacker can trigger an administrator password reset via the path /install/mysql_hy.php?riqi=0&i=0, even if install.txt exists. The issue is described across multiple sources (Red Hat, CNVD, NVD, CVE listings) as a password-reset vulnerabi...

PT-2018-14875

Name of the Vulnerable Software and Affected Versions LAOBANCMS version 2.0 Description An issue in LAOBANCMS allows an attack via the "install/mysql hy.php" endpoint with specific parameters, riqi and i, set to 0, enabling the reset of the admin password even when the install.txt file exists...

CVE-2018-19222: Improper Neutralization of Input During Web Page Generation

An issue was discovered in LAOBANCMS 2.0. It allows a /install/mysqlhy.php?riqi=0&i=0 attack to reset the admin password, even if install.txt exists...

CVE-2018-19063

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The admin account has a blank password...

Popular WooCommerce WordPress Plugin Patches Critical Vulnerability

If you own an eCommerce website built on WordPress and powered by WooCommerce plugin, then beware of a new vulnerability that could compromise your online store. Simon Scannell, a researcher at RIPS Technologies GmbH, discovered an arbitrary file deletion vulnerability in the popular WooCommerce...

NETGEAR WiFi Router R6120 - Credential Disclosure Vulnerability

Exploit for hardware platform in category web applications Exploit Title: NETGEAR WiFi Router R6120 - Credential Disclosure Exploit Author: Wadeek Hardware Version: R6120 Firmware Version: 1.0.0.30 Vendor Homepage: https://www.netgear.com/support/product/R6120.aspx Firmware Link:...

Netgear WiFi Router R6120 - Credential Disclosure

Exploit Title: NETGEAR WiFi Router R6120 - Credential Disclosure Date: 2018-10-28 Exploit Author: Wadeek Hardware Version: R6120 Firmware Version: 1.0.0.30 Vendor Homepage: https://www.netgear.com/support/product/R6120.aspx Firmware Link:...

CVE-2018-10824

Summary of CVE-2018-10824 (D-Link routers): A directory-traversal/LFI vulnerability affects multiple D-Link devices (DWR-116, DIR-140L, DIR-640L, DWR-512, DWR-712, DWR-912, DWR-921, DWR-111). The administrative password is stored in plaintext in the /tmp/csman/0 file, enabling an attacker to obta...

CVE-2018-10824

An issue was discovered on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. The administrative password is stored in plaintext in the /tmp/csman/0...

CVE-2018-14081

An issue was discovered on D-Link DIR-809 A1 through 1.09, A2 through 1.11, and Guest Zone through 1.09 devices. Device passwords, such as the admin password and the WPA key, are stored in cleartext...

CVE-2018-14081: Insufficiently Protected Credentials

An issue was discovered on D-Link DIR-809 A1 through 1.09, A2 through 1.11, and Guest Zone through 1.09 devices. Device passwords, such as the admin password and the WPA key, are stored in cleartext...

Cross site request forgery (csrf)

rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user...

CVE-2018-17986

rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user...

Authentication flaw

On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger an admin password change...

CVE-2018-17881

On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger an admin password change...

CVE-2018-17881

The CVE-2018-17881 issue affects D-Link DIR-823G devices (GoAhead configuration) where the /HNAP1 SetPasswdSettings command can change the admin password without authentication. Root cause: unauthenticated access to GoAhead configuration leads to password changes. Affected product/version: D-Link...

CVE-2018-17103

An issue was discovered in GetSimple CMS v3.3.13. There is a CSRF vulnerability that can change the administrator's password via admin/settings.php. NOTE: The vendor reported that the PoC was sending a value for the nonce parameter...

CVE-2018-17102

CVE-2018-17102 affects QuickAppsCMS (QACMS) up to version 2.0.0-beta2. The issue is a Cross-Site Request Forgery (CSRF) vulnerability that can change the administrator password via the /user/me URI. Documented impact indicates high-severity outcomes (e.g., unauthorized password change) with netwo...

CVE-2018-17103

GetSimple CMS v3.3.13 is affected by a CSRF vulnerability that can change the administrator password via admin/settings.php. The issue is evidenced in multiple sources (NVD/CVE-2018-17103, CNVD-2018-19747, OSV, CVE records). The root cause is a CSRF flaw possibly related to nonce handling, enabli...

PT-2018-13897 · Getsimple · Getsimple Cms

Name of the Vulnerable Software and Affected Versions: GetSimple CMS version 3.3.13 Description: An issue was discovered that allows for a CSRF vulnerability, which can change the administrator's password via the "admin/settings.php" endpoint. The vendor reported that the proof of concept was...