2954 matches found
PT-2018-13710
Name of the Vulnerable Software and Affected Versions CScms version 4.1 Description The issue concerns a CSRF vulnerability in the Setting.php file within the CScms software. This vulnerability can be exploited via the "admin.php/setting/ftp save" endpoint. Recommendations For CScms version 4.1,...
CVE-2018-16732: Cross-Site Request Forgery (CSRF)
\upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftpsave...
CVE-2018-15474: Improper Neutralization of Formula Elements in a CSV File
CSV Injection aka Excel Macro Injection or Formula Injection in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier allows remote attackers to exfiltrate sensitive data and to execute arbitrary code via a value that is mishandled in a CSV export. NOTE: the vendor has stated "th...
CVE-2018-16449
CVE-2018-16449 affects OneThink 1.1.141212, enabling cross-site request forgery (CSRF) to perform admin actions: adding a page (admin.php?s=/Channel/add.html), adding a blog (admin.php?s=/Article/update.html), and changing audit state (admin.php?s=/Article/setStatus/status/1.html). The connected ...
PT-2018-13576
Name of the Vulnerable Software and Affected Versions OneThink version 1.1.141212 Description The issue allows for Cross-Site Request Forgery CSRF attacks, which can be used to perform unauthorized actions on the application. Specifically, it affects the addition of pages via...
PT-2018-13575
Name of the Vulnerable Software and Affected Versions Cscms version 4 Description The issue allows for CSRF attacks, enabling unauthorized actions such as creating a member, authenticating vip members, creating a super administrator, and creating a web editor through specific API endpoints:...
CVE-2018-16448: Cross-Site Request Forgery (CSRF)
Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...
CVE-2018-16449: Cross-Site Request Forgery (CSRF)
OneThink 1.1.141212 allows CSRF for adding a page via admin.php?s=/Channel/add.html, adding a blog via admin.php?s=/Article/update.html, and setting the audit state via admin.php?s=/Article/setStatus/status/1.html...
CVE-2018-16337
An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save...
CVE-2018-16338
An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via admin.php?mod=users and subsequently add a page or menu, or submit a topic...
CVE-2018-16338
An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via admin.php?mod=users and subsequently add a page or menu, or submit a topic...
Cross site request forgery (csrf)
admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password...
CVE-2018-16331
admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password...
CVE-2018-16331
The CVE-2018-16331 entry concerns DamiCMS v6.0.0 where the admin.php?s=/Admin/doedit endpoint is vulnerable to CSRF, enabling an attacker to change the administrator password. The related connected records confirm: (1) affected software and version (DamiCMS 6.0.0), (2) the vulnerability type (CSR...
CVE-2018-16331
admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password...
PT-2018-13499
Name of the Vulnerable Software and Affected Versions Cscms version 4.1.8 Description An issue was discovered that allows modification of a website's basic configuration via a CSRF vulnerability. This can be exploited through the "upload/admin.php/setting/save" API endpoint. Recommendations For...
PT-2018-13500
Name of the Vulnerable Software and Affected Versions AuraCMS version 2.3 Description An issue was discovered that allows a CSRF vulnerability, enabling an attacker to change the administrator's password via the "admin.php?mod=users" endpoint and subsequently add a page or menu, or submit a topic...
PT-2018-13494
Name of the Vulnerable Software and Affected Versions DamiCMS version 6.0.0 Description The issue allows for a CSRF attack to change the administrator account's password through the "admin.php?s=/Admin/doedit" endpoint. Recommendations For DamiCMS version 6.0.0, update to a newer version that...
CVE-2018-16337: Cross-Site Request Forgery (CSRF)
An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save...