CVE-2020-20514

A Cross-Site Request Forgery CSRF in Maccms v10 via admin.php/admin/admin/del/ids/.html allows authenticated attackers to delete all users...

CVE-2020-19951

A cross-site request forgery CSRF in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the application...

CVE-2021-22949

A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to duplicate files which can lead to UI inconvenience, and exhaustion of disk space.Credit for discovery: "Solar Security CMS Research Team"...

CVE-2021-22950

Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowing attachments to comments in the conversation section to be deleted.Credit for discovery: "Solar Security Research Team"...

CVE-2021-41083

Dada Mail is a web-based e-mail list management system. In affected versions a bad actor could give someone a carefully crafted web page via email, SMS, etc, that - when visited, allows them control of the list control panel as if the bad actor was logged in themselves. This includes changing any...

CVE-2021-41083

CVE-2021-41083 is a CSRF vulnerability in Dada Mail prior to version 11.16.0. In affected versions, a user who is logged into the list control panel could be induced to visit a malicious page (via phishing email/SMS, etc.) that allows an attacker to perform actions in the user’s session, includin...

CVE-2021-24584

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the editposts capability contributor+ to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such...

CVE-2020-21321

emlog v6.0 contains a Cross-Site Request Forgery CSRF via /admin/link.php?action=addlink, which allows attackers to arbitrarily add articles...

CVE-2021-40964

A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload a file with Admin credentials or with the CSRF vulnerability with the "fullpath" parameter containing path traversal strings ../ and ..\ in order to escape the server's...

Path traversal

A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload a file with Admin credentials or with the CSRF vulnerability with the "fullpath" parameter containing path traversal strings ../ and ..\ in order to escape the server's...

CVE-2021-40964

A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload a file with Admin credentials or with the CSRF vulnerability with the "fullpath" parameter containing path traversal strings ../ and ..\ in order to escape the server's...

PT-2021-23020

Name of the Vulnerable Software and Affected Versions TinyFileManager versions up to and including 2.4.6 Description A Cross-Site Request Forgery CSRF issue exists that allows attackers to upload files and run OS commands by inducing the Administrator user to browse a URL controlled by an attacke...

CVE-2021-37201

A vulnerability has been identified in SINEC NMS All versions V1.0 SP1. The web interface of affected devices is vulnerable to a Cross-Site Request Forgery CSRF attack. This could allow an attacker to manipulate the SINEC NMS configuration by tricking an unsuspecting user with administrative...

Cross site request forgery (csrf)

A cross-site request forgery CSRF in KiteCMS V1.1 allows attackers to arbitrarily add an administrator account...

CVE-2021-24431

The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This could allow attackers to make a logged in admin change the settings, and set Cross-Site Scripting...

Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb

✍️ Description Hello dear Rdiffweb team. I found a CSRF vulnerability on following endpoint that attackers able to Create a SSH key with PoC.html 🕵️‍♂️ Proof of Concept 1. User with right privileges should be logged in Firefox or Safari. 2. Users go to a website that contain PoC.html 3.after...

Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb

✍️ Description Hello dear Rdiffweb team. I found a CSRF vulnerability on following endpoint that attackers able to Delete users with PoC.html 🕵️‍♂️ Proof of Concept 1. user with right privileges should be logged in Firefox or Safari. 2. Users go to a website that contain PoC.html 3.after visiting...

CVE-2020-19280

Jeesns 1.4.2 contains a cross-site request forgery CSRF which allows attackers to escalate privileges and perform sensitive program operations...

CVE-2020-19264

A cross-site request forgery CSRF in MipCMS v5.0.1 allows attackers to arbitrarily add users via index.php?s=/user/ApiAdminUser/itemAdd...

Improper Privilege Management in microweber/microweber

✍️ Description A simple user without Super Admin access is able to add further users to the system. 🕵️‍♂️ Proof of Concept BurpSuite or proxy utility is required - 1;Simply add a simple User roled user USER A . - 2; Log in with USER A - 3; Obtain the X-Csrf-Token and the Cookie value of USER A - 4;...