CVE-2026-54348: Improper Neutralization of Special Elements used in an SQL Command

Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in paneladmins.ip without enforcing numeric element types. When the poisoned...

CVE-2026-73482: Cross-Site Request Forgery (CSRF)

phpList before 3.7.0-RC5 contains a cross-site request forgery CSRF vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request ?page=admins&delete=N that is not protected by a CSRF token the central verifyCsrfGetToken check uses...

CVE-2025-10082

CVE-2025-10082 affects SourceCodester Online Polling System 1.0. The vulnerability resides in /admin/manage-admins.php, where manipulation of the email parameter leads to SQL injection. Exploitation can be performed remotely and public disclosures exist. Multiple connected sources confirm the iss...

CVE-2025-10082: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in SourceCodester Online Polling System 1.0. Affected is an unknown function of the file /admin/manage-admins.php. Such manipulation of the argument email leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and m...

Business Logic Errors

froxlor/froxlor is vulnerable to Business Logic Errors. The vulnerability exists in the update function pf Admins.php because the admin name is not properly validated for spaces which allows an attacker to save a user name with just spaces/...

Thickbox Gallery 2.0 - (admins.php) Admin Data Disclosure Vulnerability

No description provided by source. + Thickbox Gallery v2 Admin Data Disclosure + Discovered By SirGod + www.mortal-team.org + Greetz : E.M.I.N.E.M,Ras,Puscasmarin,ToxicBlood,MesSiAH,xZu,HrN,kemrayz + Arbitrary Admin Data Disclosure - Go here and you will see the admin data login name + crypted...

CVE-2009-4828: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in administration/admins.php in Ad Manager Pro aka AdManagerPro 3.0 allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an admincreated action. NOTE: some of these details are...

Web Directory PRO (admins.php) Change Admin Password Exploit

Exploit for unknown platform in category web applications ============================================================ Web Directory PRO admins.php Change Admin Password Exploit ============================================================ change password Web Directory PRO MODIFY Login Password...

Web Directory PRO - Admins.php Change Admin Password

Web Directory PRO - Admins.php Change Admin Password change password Web Directory PRO MODIFY Login Password TypeSubadminAdmin Categories ArtBusinessComputersGamesHealth & FitnessNewsSportsRecreationInternetTeen & KidsReferenceEducationRegionalSocietyScienceHome & FamilyWorldShoppingWeb...

Web Directory PRO - 'Admins.php' Change Admin Password

change password Web Directory PRO MODIFY Login Password TypeSubadminAdmin Categories ArtBusinessComputersGamesHealth & FitnessNewsSportsRecreationInternetTeen & KidsReferenceEducationRegionalSocietyScienceHome & FamilyWorldShoppingWeb HostingDedicated ServersISPHardwareSoftwareSecurity...

CVE-2008-3859: Undefined Security Weakness

Davlin Thickbox Gallery 2 allows remote attackers to obtain the administrative username and MD5 password hash via a direct request to conf/admins.php...

Thickbox Gallery v2 (admins.php) Admin Data Disclosure Vulnerability

Exploit for unknown platform in category web applications ==================================================================== Thickbox Gallery v2 admins.php Admin Data Disclosure Vulnerability ==================================================================== + Arbitrary Admin Data Disclosure ...

Design/Logic Flaw

manage-admins.php in eSyndiCat Pro 1.x allows remote attackers to create additional administrative accounts, and have other unspecified impact, via modified username, newpass, newpass2, status, super, and certain other parameters in an add action...

CVE-2007-2785

CVE-2007-2785 concerns manage-admins.php in eSyndiCat Pro 1.x. The vulnerability allows remote attackers to create additional administrative accounts by modifying parameters such as username, new_pass, new_pass2, status, and super in an add action. This implies unauthenticated remote write access...

CVE-2007-2785

manage-admins.php in eSyndiCat Pro 1.x allows remote attackers to create additional administrative accounts, and have other unspecified impact, via modified username, newpass, newpass2, status, super, and certain other parameters in an add action...

CVE-2007-2785: Undefined Security Weakness

manage-admins.php in eSyndiCat Pro 1.x allows remote attackers to create additional administrative accounts, and have other unspecified impact, via modified username, newpass, newpass2, status, super, and certain other parameters in an add action...