CVE-2018-18784

An issue was discovered in zzcms 8.3. SQL Injection exists in admin/tagmanage.php via the tabletag parameter. This needs an admin user login...

Sql injection

An issue was discovered in zzcms 8.3. SQL Injection exists in admin/classmanage.php via the tablename parameter. This needs an admin user login...

CVE-2018-18788

An issue was discovered in zzcms 8.3. SQL Injection exists in admin/classmanage.php via the tablename parameter. This needs an admin user login...

CVE-2018-18784

An issue was discovered in zzcms 8.3. SQL Injection exists in admin/tagmanage.php via the tabletag parameter. This needs an admin user login...

CVE-2018-18790

An issue was discovered in zzcms 8.3. SQL Injection exists in admin/specialadd.php via a zxbigclassid cookie. This needs an admin user login...

CVE-2018-18784: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in zzcms 8.3. SQL Injection exists in admin/tagmanage.php via the tabletag parameter. This needs an admin user login...

CVE-2018-18790: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in zzcms 8.3. SQL Injection exists in admin/specialadd.php via a zxbigclassid cookie. This needs an admin user login...

CVE-2018-18788: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in zzcms 8.3. SQL Injection exists in admin/classmanage.php via the tablename parameter. This needs an admin user login...

CVE-2018-18486

An issue was discovered in PHPSHE 1.7. SQL injection exists via the admin.php?mod=user&act=del userid parameter...

PHP-SHOP Master 1.0 Cross Site Request Forgery

Exploit Title: PHP-SHOP master 1.0 - Cross-Site Request Forgery Add admin Exploit Author : Alireza Norkazemi Date: 2018-10-15 Vendor Homepage : https://github.com/joeyrush/PHP-SHOP Software link: https://github.com/joeyrush/PHP-SHOP/archive/master.zip Version: 1.0 Tested on: Windows 10 CVE: N/A...

Users on IOS devices can not log into XenApp after upgrading to Citrix Workspace app for iOS, authentication broken in 17.08

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Users on Ipad IOS devices can no longer log into XenApp after upgrading Citrix Receiver to Citrix...

Academic Timetable Final Build 7.0b - Cross-Site Request Forgery (Add Admin)

Academic Timetable Final Build 7.0b - Cross-Site Request Forgery Add Admin Exploit Title: Academic Timetable Final Build 7.0b - Cross-Site Request Forgery Add Admin Dork: N/A Date: 2018-10-13 Exploit Author: Ihsan Sencan Vendor Homepage: http://geoffpartridge.net/ Software Link:...

Storage-type cross-site scripting vulnerability at the front-end posting message of PawnBuilder CMS

SmallBuild CMS is a website management backend based on the OneThink open source framework. A stored cross-site scripting vulnerability exists in the front-end posting message of PawnBuilder CMS. Attackers by building a CSRF add administrator user can insert malicious js code in the page to obtai...

CVE-2018-17986

rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user...

CVE-2018-17986: Cross-Site Request Forgery (CSRF)

rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user...

CVE-2018-17986

rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user...

CVE-2018-17986

CVE-2018-17986 affects razorCMS 3.4.8. The vulnerability is a Cross-Site Request Forgery (CSRF) in the rars/user/data page that allows changing the password of an admin user. No exploitation details are provided in the connected documents. Impact is described by multiple sources as enabling passw...

CVE-2018-17826

HisiPHP 1.0.8 is vulnerable to CSRF via admin.php/admin/user/adduser.html, enabling an attacker to create an administrator account. This account can then leverage app/common/model/AdminAnnex.php to add .php to the allowed file-upload types list (.jpg, .png, .gif, .jpeg, .ico), facilitating arbitr...

CVE-2018-17826: Cross-Site Request Forgery (CSRF)

HisiPHP 1.0.8 allows CSRF via admin.php/admin/user/adduser.html to add an administrator account. The attacker can then use that account to execute arbitrary PHP code by leveraging app/common/model/AdminAnnex.php to add .php to the default list of allowable file-upload types .jpg, .png, .gif, .jpe...

CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...