CVE-2026-73482: Cross-Site Request Forgery (CSRF)

phpList before 3.7.0-RC5 contains a cross-site request forgery CSRF vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request ?page=admins&delete=N that is not protected by a CSRF token the central verifyCsrfGetToken check uses...

GHSA-VG28-83RP-8XX4 Frigte has broken access control viewer user can delete admin and other users account

Summary Users with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity. Details Endpoint DELETE /api/users/admin is enable to anonymous user. PoC I deleted admin user on demo.frigate.video: Impact It this leads to denial of servi...

KiloView Encoder Series (Update A)

RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthenticated attacker to create or delete administrator accounts, granting full administrative control. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of...

The vulnerability of the Grafana monitoring and observation platform, related to access control errors, allows a violator to disrupt the operation of the program.

The vulnerability of the Grafana monitoring and observation platform is related to access control errors. Exploiting this vulnerability could allow a malicious actor to disrupt the program’s operation by deleting the server administrator’s account...

UBUNTU-CVE-2025-3580

An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: 1. An Organization administrator...

CVE-2025-3580

CVE-2025-3580 (Grafana Open Source) : An access-control flaw in the DELETE /api/org/users/ endpoint allows an Organization administrator to permanently delete the Server administrator account. If the sole Server admin is deleted, the Grafana instance becomes unmanageable with no super-user permis...

PT-2025-1457 · Pat Infinite Solutions · Helpdeskadvanced

Name of the Vulnerable Software and Affected Versions: Pat Infinite Solutions HelpdeskAdvanced versions = 11.0.33 Description: The issue concerns incorrect access control, allowing users with low privileges to delete administrator accounts. This can be achieved by sending a request to the...

CVE-2023-38989: Missing Authorization

An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role information...

PT-2023-11615 · Beescms · Beescms

Name of the Vulnerable Software and Affected Versions: beescms version 4 Description: A Cross Site Request Forgery CSRF issue allows attackers to delete the administrator account via a crafted request to "/admin/admin admin.php". This can be exploited by sending a malicious request to the specifi...

CVE-2020-22334: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability in beescms v4 allows attackers to delete the administrator account via crafted request to /admin/adminadmin.php...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...

CVE-2021-20842

Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...

CVE-2021-20842: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...

Indexhibit 跨站请求伪造漏洞

Indexhibit is a web-based content management system. A cross-site request forgery vulnerability exists in Indexhibit version 2.1.5. An attacker can exploit this vulnerability to arbitrarily delete an administrator account...

Cross site request forgery (csrf)

A cross site request forgery CSRF vulnerability in the configure.html component of Ponzu 0.11.0 allows attackers to change user and administrator credentials, and add or delete administrator accounts...

Cross site request forgery (csrf)

An issue was discovered in YXcms 1.4.7. Cross-site request forgery CSRF vulnerability in protected/apps/admin/controller/adminController.php allows remote attackers to delete administrator accounts via index.php?r=admin/admin/admindel...

TomatoCart 1.0.1 - Multiple CSRF Vulnerabilities

No description provided by source. !--- Title: TomatoCart 1.0.1 Multiple CSRF Vulnerabilities Author: 10n1z3d 10n1z3datwdotcn Date: Sun 11 Jul 2010 05:01:51 PM EEST Vendor: http://www.tomatocart.com/ Download:...

Simple PHP Agenda 2.2.8 - Cross-Site Request Forgery (Add Admin Add Event)

Simple PHP Agenda 2.2.8 - Cross-Site Request Forgery Add Admin Add Event +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Simple PHP Agenda = 2.2.8 CSRF Add Admin - Add Event Date : 29-03-2012 Author...

Simple PHP Agenda 2.2.8 Cross Site Request Forgery

+--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Simple Php Agenda = 2.2.8 CSRF Add Admin/Add New Event Date : 29-03-2012 Author : Ivano Binetti http://ivanobinetti.com Software link :...

TomatoCart 1.0.1 Multiple CSRF Vulnerabilities

Exploit for php platform in category web applications ============================================== TomatoCart 1.0.1 Multiple CSRF Vulnerabilities ============================================== Date: Sun 11 Jul 2010 05:01:51 PM EEST Vendor: http://www.tomatocart.com/ Download:...