DAMICMS 6.0.0 - Cross-Site Request Forgery (Add Admin)

DAMICMS 6.0.0 - Cross-Site Request Forgery Add Admin history.pushState'', '', '/'...

Design/Logic Flaw

An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the admin.php file of the ./cpshop/ module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack vector of the vulnerability...

CVE-2018-13001

An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the admin.php file of the ./cpshop/ module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack vector of the vulnerability...

CVE-2018-13001

Sandoba CP:Shop v2016.1 contains a cross-site scripting (XSS) vulnerability in the cpshop/admin.php module. The CVE describes a non-persistent XSS that can be triggered via GET parameters (path, search, rename, or dir) and injected into client-side code. Connected sources corroborate the issue ac...

CVE-2018-13001

An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the admin.php file of the ./cpshop/ module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack vector of the vulnerability...

PT-2018-11530

Name of the Vulnerable Software and Affected Versions Sandoba CP:Shop version v2016.1 Description A cross-site scripting XSS issue was found, allowing remote attackers to inject script codes into the client-side of the web application through vulnerable parameters. The attack vector is...

CVE-2018-13001: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the admin.php file of the ./cpshop/ module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack vector of the vulnerability...

CVE-2018-12603

Cross-site request forgery CSRF vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authentication of unspecified users for requests that add administrator users via the s parameter, a related issue to CVE-2018-12114...

CVE-2018-12603: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authentication of unspecified users for requests that add administrator users via the s parameter, a related issue to CVE-2018-12114...

CVE-2018-12114

CVE-2018-12114 affects MacCMS 10. A CSRF vulnerability allows an attacker to add administrator user accounts via the request targeting admin.php/admin/admin/info.html. The issue is demonstrated in public references and exploit entries, including an explicit POST form example used to create a new ...

CVE-2018-12114

Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts...

CVE-2018-12114: Cross-Site Request Forgery (CSRF)

Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts...

PT-2018-11024

Name of the Vulnerable Software and Affected Versions Maccms version 10 Description The issue allows for CSRF, enabling attackers to add user accounts via the admin.php/admin/admin/info.html endpoint. Recommendations For Maccms version 10, as a temporary workaround, consider restricting access to...

Cross site request forgery (csrf)

An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker via spear phishing/social engineering, the attacker can change the plugin settings. The function...

CVE-2018-11633: Cross-Site Request Forgery (CSRF)

An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker via spear phishing/social engineering, the attacker can change the plugin settings. The function...

PT-2018-10717

Name of the Vulnerable Software and Affected Versions MULTIDOTS Woo Checkout for Digital Goods plugin version 2.1 Description An issue allows attackers to change plugin settings by tricking an admin user into visiting a crafted URL. The woo checkout settings page function in the file...

CVE-2018-11527: Cross-Site Request Forgery (CSRF)

An issue was discovered in CScms v4.1. A Cross-site request forgery CSRF vulnerability in plugins/sys/admin/Sys.php allows remote attackers to change the administrator's username and password via /admin.php/sys/editpasssave...

PT-2018-10639

Name of the Vulnerable Software and Affected Versions CScms version 4.1 Description A Cross-site request forgery CSRF issue allows remote attackers to change the administrator's username and password via the "admin.php/sys/editpass save" API endpoint. Recommendations For CScms version 4.1, as a...

CVE-2018-11018

PbootCMS v1.0.7 contains a Cross‑Site Request Forgery (CSRF) vulnerability in apps/admin/controller/system/RoleController.php that enables remote attackers to add administrator accounts via admin.php/role/add.html. Affected software: PbootCMS 1.0.7. Root cause: CSRF in role management workflow al...

CVE-2018-11018: Cross-Site Request Forgery (CSRF)

An issue was discovered in PbootCMS v1.0.7. Cross-site request forgery CSRF vulnerability in apps/admin/controller/system/RoleController.php allows remote attackers to add administrator accounts via admin.php/role/add.html...