Privilege escalation

An issue has been discovered in Novastar-VNNOX-iCare Novaicare 7.16.0 that gives attacker privilege escalation and allows attackers to view corporate information and SMTP server details, delete users, view roles, and other unspecified impacts...

CVE-2021-38289

An issue has been discovered in Novastar-VNNOX-iCare Novaicare 7.16.0 that gives attacker privilege escalation and allows attackers to view corporate information and SMTP server details, delete users, view roles, and other unspecified impacts. NOTE: As of April 2026, the vendor has officially...

Novastar-VNNOX-iCare Novaicare 安全漏洞

Novastar-VNNOX-iCare Novaicare is an application used to centrally monitor the status of LED screen displays by Xi'an Novaicare Technology Co. in China. A security vulnerability exists in Novastar-VNNOX-iCare Novaicare version 7.16.0, which can be exploited by an attacker to elevate privileges an...

Moodle 授权问题漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. a security vulnerability exists in Moodle, which stems from an application that does not properly impose security restrictions. A remo...

PeTeReport 跨站请求伪造漏洞

PeTeReport is an open source application vulnerability reporting tool. Designed to assist penetration testing/red team efforts by simplifying the task of report writing and generation, PeTeReport suffers from a cross-site request forgery vulnerability that could be exploited by attackers to trick...

CVE-2020-20514

A Cross-Site Request Forgery CSRF in Maccms v10 via admin.php/admin/admin/del/ids/.html allows authenticated attackers to delete all users...

Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb

✍️ Description Hello dear Rdiffweb team. I found a CSRF vulnerability on following endpoint that attackers able to Delete users with PoC.html 🕵️‍♂️ Proof of Concept 1. user with right privileges should be logged in Firefox or Safari. 2. Users go to a website that contain PoC.html 3.after visiting...

Projectworlds Online Examination System Cross-Site Request Forgery Vulnerability

Projectworlds Online Examination System is an online examination system. projectworlds Online Examination System cross-site request forgery vulnerability, which can be exploited by attackers to delete existing users...

CVE-2020-25411

Projectworlds Online Examination System 1.0 is vulnerable to CSRF, which allows a remote attacker to delete the existing user...

Project Worlds Online Examination System 跨站请求伪造漏洞

Projectworlds Online Examination System is an online examination system. projectworlds Online Examination System cross-site request forgery vulnerability, which can be exploited by attackers to delete existing users...

CVE-2020-24033

An issue was discovered in fs.com S3900 24T4S 1.7.0 and earlier. The form does not have an authentication or token authentication mechanism that allows remote attackers to forge requests on behalf of a site administrator to change all settings including deleting users, creating new users with...

CVE-2020-17474

A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to create arbitrary new users, elevate users to administrators, delete users, and download user faces from the database...

CVE-2020-13426

The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery CSRF vulnerability in the forms it presents, allowing the possibility of deleting records users when an ID is known...

CVE-2020-9454

A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploa...

CVE-2016-10883

The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users...

Dolibarr ERP/CRM Cross-Site Request Forgery Vulnerability

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A cross-site request forgery vulnerability exists in Dolibarr...

CVE-2019-8902

An issue was discovered in idreamsoft iCMS through 7.0.14. A CSRF vulnerability can delete users' articles via the public/api.php?app=user URI...

CVE-2014-6046

Multiple cross-site request forgery CSRF vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that 1 delete active users by leveraging improper validation of CSRF tokens or that 2 delete open questions, 3 activate users, 4...

Cross site request forgery (csrf)

EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users...

EasyCMS Cross-Site Request Forgery Vulnerability

EasyCMS is a scalable lightweight open source content management system CMS written in PHP. A cross-site request forgery vulnerability exists in EasyCMS version 1.3. A remote attacker can exploit this vulnerability to delete users with the help of index.php?s=/admin/user/delAll URI...