2956 matches found
PT-2018-12942
Name of the Vulnerable Software and Affected Versions OneThink version 1.1 Description An issue was discovered that allows for a CSRF vulnerability. The vulnerability can be exploited through the "admin.php?s=/User/add.html" endpoint, which can add a user. Recommendations For OneThink version 1.1...
PT-2018-12941
Name of the Vulnerable Software and Affected Versions OneThink version 1.1 Description A CSRF issue was found in the admin.php?s=/AuthManager/addToGroup.html endpoint, allowing for the potential granting of administrator privileges. Recommendations For OneThink version 1.1, as a temporary...
CVE-2018-15198: Cross-Site Request Forgery (CSRF)
An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user...
CVE-2018-15197: Cross-Site Request Forgery (CSRF)
An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges...
PT-2018-12795
Name of the Vulnerable Software and Affected Versions ukcms versions 1.1.7 and earlier Description A file upload issue exists due to insufficient filtering of the file upload type. An attacker can exploit this by uploading a script Trojan to the admin.php/admin/configset/index/group/upload.html...
CVE-2018-14911: Unrestricted Upload of File with Dangerous Type
A file upload vulnerability exists in ukcms v1.1.7 and earlier. The vulnerability is due to the system not strictly filtering the file upload type. An attacker can exploit the vulnerability to upload a script Trojan to admin.php/admin/configset/index/group/upload.html to gain server control by...
blog.seniorennet.nl XSS vulnerability
Open Bug Bounty ID: OBB-648249 Description| Value ---|--- Affected Website:| blog.seniorennet.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
CVE-2018-14069
SRCMS V2.3.1 contains a CSRF flaw that allows an attacker to add a user account via admin.php?m=Admin&c=member&a=add. The affected component is the user-management functionality; the root cause is a CSRF vulnerability in the request handling for adding members. Impact statements in the sources in...
PT-2018-12319
Name of the Vulnerable Software and Affected Versions SRCMS version 2.3.1 Description An issue in SRCMS allows for a CSRF vulnerability, enabling the addition of an admin account via the "admin.php?m=Admin&c=manager&a=add" API endpoint. Recommendations For SRCMS version 2.3.1, as a temporary...
PT-2018-12320
Name of the Vulnerable Software and Affected Versions SRCMS version 2.3.1 Description A CSRF issue allows adding a user account via the "admin.php?m=Admin&c=member&a=add" API endpoint. Recommendations For SRCMS version 2.3.1, consider implementing CSRF protection measures to prevent unauthorized...
CVE-2018-14068: Cross-Site Request Forgery (CSRF)
An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add an admin account via admin.php?m=Admin&c=manager&a=add...
CVE-2018-14069: Cross-Site Request Forgery (CSRF)
An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add a user account via admin.php?m=Admin&c=member&a=add...
PT-2018-5072
Name of the Vulnerable Software and Affected Versions PHP FormMail Generator affected versions not specified Description The issue allows a remote unauthenticated user to bypass authentication and access the administrator panel. This can be achieved by navigating directly to the...
CVE-2016-9482: Authentication Bypass by Assumed-Immutable Data
Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator panel by navigating directly to /admin.php?mod=admin&func=panel...
PT-2018-12278
Name of the Vulnerable Software and Affected Versions waimai Super Cms version 20150505 Description The issue allows for the addition of an admin account via the admin.php?m=Member&a=adminadd API endpoint, due to a CSRF vulnerability. Recommendations For waimai Super Cms version 20150505, as a...
CVE-2018-14014: Cross-Site Request Forgery (CSRF)
In waimai Super Cms 20150505, there is a CSRF vulnerability that can add an admin account via admin.php?m=Member&a=adminadd...
CVE-2018-13031
DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account...
CVE-2018-13031
DamiCMS CVE-2018-13031 affects versions 6.0.0 and 6.1.0 . The vulnerability is a Cross-Site Request Forgery (CSRF) on the endpoint admin.php?s=/Admin/doadd, allowing an attacker to add an administrator account. The root cause is insufficient CSRF protection on that admin action; the impact is the...
PT-2018-11548
Name of the Vulnerable Software and Affected Versions DamiCMS versions 6.0.0 through 6.1.0 Description The issue allows for a CSRF attack via the "admin.php?s=/Admin/doadd" endpoint to add an administrator account. Recommendations For DamiCMS versions 6.0.0 through 6.1.0, consider restricting...