2947 matches found
CVE-2008-6714: Improper Authentication
admin.php in xeCMS 1.0.0 RC2 and earlier allows remote attackers to bypass authentication and access the admin panel by setting the xecmsusername cookie...
CVE-2008-6639
CVE-2008-6639 affects AjaXplorer 2.3.3 and 2.3.4. A CSRF flaw in admin.php allows remote attackers to hijack administrator sessions and issue password-change requests via the update_user_pwd action. The description does not provide exploit details or verification steps, and there is no remediatio...
CVE-2008-6639: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in admin.php in AjaXplorer 2.3.3 and 2.3.4 allows remote attackers to hijack the authentication of administrators for requests that modify passwords via the updateuserpwd action...
CVE-2008-6643: Undefined Security Weakness
LokiCMS 0.3.4 and possibly earlier versions does not properly restrict access to administrative functions, which allows remote attackers to bypass intended restrictions and modify configuration settings via the LokiACTION parameter in a direct request to admin.php...
CVE-2008-6585
Cross-site request forgery CSRF vulnerability in html/admin.php in TorrentFlux 2.3 allows remote attackers to hijack the authentication of administrators for requests that add new accounts via the addUser action...
CVE-2008-6585
CVE-2008-6585 concerns a Cross-site request forgery (CSRF) vulnerability in TorrentFlux 2.3, specifically in html/admin.php, that allows remote attackers to hijack administrator authentication to add new accounts via the addUser action. The affected component is the web administration interface’s...
CVE-2008-6585: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in html/admin.php in TorrentFlux 2.3 allows remote attackers to hijack the authentication of administrators for requests that add new accounts via the addUser action...
CVE-2008-6406
Cross-site scripting XSS vulnerability in admin.php in DataLife Engine DLE 7.2 allows remote attackers to inject arbitrary web script or HTML via the query string...
CVE-2008-6406
CVE-2008-6406 is an XSS vulnerability reported in DataLife Engine (DLE) 7.2, located in admin.php and exploitable via the query string. The affected component is the admin interface; the underlying issue is improper handling of user-supplied input in the query parameters, allowing an attacker to ...
CVE-2008-6406: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in admin.php in DataLife Engine DLE 7.2 allows remote attackers to inject arbitrary web script or HTML via the query string...
Design/Logic Flaw
zFeeder 1.6 allows remote attackers to gain administrative access via a direct request to admin.php...
CVE-2009-0807
CVE-2009-0807 affects zFeeder 1.6. The vulnerability is an admin authentication bypass allowing remote attackers to gain administrative access by accessing the admin.php page directly. Connected Nessus data notes the default installation of zFeeder uses empty values for the admin username and pas...
CVE-2009-0807: Undefined Security Weakness
zFeeder 1.6 allows remote attackers to gain administrative access via a direct request to admin.php...
CVE-2008-6360
Cross-site scripting XSS vulnerability in the userranks feature in modules/system/admin.php in ImpressCMS 1.0.2 final allows remote attackers to inject arbitrary web script or HTML via the ranktitle parameter. NOTE: some of these details are obtained from third party information...
CVE-2008-6360: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the userranks feature in modules/system/admin.php in ImpressCMS 1.0.2 final allows remote attackers to inject arbitrary web script or HTML via the ranktitle parameter. NOTE: some of these details are obtained from third party information...
CVE-2008-6302
TurnkeyForms Local Classifieds allows remote attackers to bypass authentication and gain administrative access via a direct request to SiteAdmin/admin.php...
CVE-2008-6296: Undefined Security Weakness
admin.php in Maran PHP Shop allows remote attackers to bypass authentication and gain administrative access by setting the user cookie to "demo."...
CVE-2008-6302: Undefined Security Weakness
TurnkeyForms Local Classifieds allows remote attackers to bypass authentication and gain administrative access via a direct request to SiteAdmin/admin.php...
Directory traversal
Directory traversal vulnerability in admin.php in Potato News 1.0.0 allows remote attackers to include and execute arbitrary files via a .. dot dot in the user cookie parameter...