2954 matches found
eLitius 1.0 (manage-admin.php) Add Admin/Change Password Exploit
No description provided by source. title Powered by eLitius Version 1.0 Change Password /title form action="http://esyndicat.org/admin/manage-admin.php" method="post" name="adminForm" table class="admintable" tbodytr td table class="adminform" cellpadding="0" cellspacing="0" tbody tr th...
CVE-2008-6725: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in CMScout 2.06 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to 1 index.php in a mythings page mythings.php and 2 the users page in admin.php...
CVE-2008-6726: Improper Limitation of a Pathname to a Restricted Directory
Multiple directory traversal vulnerabilities in CMScout 2.06, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the bit parameter to 1 admin.php and 2 index.php, different vectors than CVE-2008-3415...
eLitius 1.0 - '/manage-admin.php' Arbitrary Add Admin/Change Password
Powered by eLitius Version 1.0 Change Password Change Password Of admin Username: Password: Email: Dork: Powered by eLitius Version 1.0 Greetz To: Dos-Dz TeaM Snakes TeaM His0k4 Cod3d By ThE g0bL!N /tr...
eLitius 1.0 - manage-admin.php Arbitrary Add AdminChange Password
eLitius 1.0 - manage-admin.php Arbitrary Add AdminChange Password Powered by eLitius Version 1.0 Change Password Change Password Of admin Username: Password: Email: Dork: Powered by eLitius Version 1.0 Greetz To: Dos-Dz TeaM Snakes TeaM His0k4 td style="font-weigh...
X10media Mp3 Search Engine < 1.6.2 - Admin Access
THUNDER Product: X10media Mp3 Search Engine v1.x Admin Access Vulnerability Author : THUNDER File : admin/admin.php Vulnerable Code / User not an administrator, redirect to main page automatically. / if!$session-isAdmin header"Location: ../main.php"; else / Administrator is viewing page, so displ...
CVE-2008-6714
CVE-2008-6714 affects xeCMS 1.0.0 RC2 and earlier. The admin.php module allows remote attackers to bypass authentication and access the admin panel by setting the xecms_username cookie, effectively elevating access without valid credentials. Root cause: authentication bypass via manipulated cooki...
CVE-2008-6714: Improper Authentication
admin.php in xeCMS 1.0.0 RC2 and earlier allows remote attackers to bypass authentication and access the admin panel by setting the xecmsusername cookie...
CVE-2008-6639
CVE-2008-6639 affects AjaXplorer 2.3.3 and 2.3.4. A CSRF flaw in admin.php allows remote attackers to hijack administrator sessions and issue password-change requests via the update_user_pwd action. The description does not provide exploit details or verification steps, and there is no remediatio...
CVE-2008-6639: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in admin.php in AjaXplorer 2.3.3 and 2.3.4 allows remote attackers to hijack the authentication of administrators for requests that modify passwords via the updateuserpwd action...
CVE-2008-6643: Undefined Security Weakness
LokiCMS 0.3.4 and possibly earlier versions does not properly restrict access to administrative functions, which allows remote attackers to bypass intended restrictions and modify configuration settings via the LokiACTION parameter in a direct request to admin.php...
CVE-2008-6585
CVE-2008-6585 concerns a Cross-site request forgery (CSRF) vulnerability in TorrentFlux 2.3, specifically in html/admin.php, that allows remote attackers to hijack administrator authentication to add new accounts via the addUser action. The affected component is the web administration interface’s...
CVE-2008-6585
Cross-site request forgery CSRF vulnerability in html/admin.php in TorrentFlux 2.3 allows remote attackers to hijack the authentication of administrators for requests that add new accounts via the addUser action...
CVE-2008-6585: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in html/admin.php in TorrentFlux 2.3 allows remote attackers to hijack the authentication of administrators for requests that add new accounts via the addUser action...
CVE-2008-6406
Cross-site scripting XSS vulnerability in admin.php in DataLife Engine DLE 7.2 allows remote attackers to inject arbitrary web script or HTML via the query string...
CVE-2008-6406
CVE-2008-6406 is an XSS vulnerability reported in DataLife Engine (DLE) 7.2, located in admin.php and exploitable via the query string. The affected component is the admin interface; the underlying issue is improper handling of user-supplied input in the query parameters, allowing an attacker to ...
CVE-2008-6406: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in admin.php in DataLife Engine DLE 7.2 allows remote attackers to inject arbitrary web script or HTML via the query string...
Design/Logic Flaw
zFeeder 1.6 allows remote attackers to gain administrative access via a direct request to admin.php...
CVE-2009-0807
CVE-2009-0807 affects zFeeder 1.6. The vulnerability is an admin authentication bypass allowing remote attackers to gain administrative access by accessing the admin.php page directly. Connected Nessus data notes the default installation of zFeeder uses empty values for the admin username and pas...