CVE-2023-2547: Missing Authorization

The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions...

WordPress Plugin Feather Login Page 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2023-20087 · WordPress · Feather Login Page

Name of the Vulnerable Software and Affected Versions: Feather Login Page plugin for WordPress versions 1.0.7 through 1.1.1 Description: The issue allows authenticated attackers with subscriber-level permissions and above to delete temporary users generated by the plugin due to a missing capabili...

SQL Injection

org.opendaylight.aaa:aaa-idm-store-h2 is vulnerable to SQL Injection attacks. A specifically crafted attack statement through the deleteUser function in UserStore.java allows a malicious user to inject and execute arbitrary SQL queries on the target system, when the /auth/v1/users/ API interface ...

CVE-2022-45931: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection issue was discovered in AAA in OpenDaylight ODL before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/UserStore.java deleteUser function is affected when the API interface /auth/v1/users/ is used...

OpenDaylight SQL注入漏洞

OpenDaylight ODL is an open source SDN controller from OpenDaylight Open Source. A security vulnerability exists in versions of OpenDaylight ODL prior to 0.16.5, which originates in its aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/UserStore.java component in the /auth/ v1/user...

PT-2022-27690 · Unknown · Opendaylight

Name of the Vulnerable Software and Affected Versions: OpenDaylight versions prior to 0.16.5 Description: A SQL injection issue was discovered in the AAA component of OpenDaylight. The deleteUser function in the UserStore.java file is affected when the API interface "/auth/v1/users/" is used...

Sql injection

Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a SQL injection vulnerability via the 'roleId' parameter of the editRole and deletUser modules...

CVE-2020-23045

Macrob7 Macs Framework Content Management System, version 1.14f, is reported to contain an SQL injection vulnerability in the editRole and deletUser modules triggered by the roleId parameter. The root cause is improper handling of the roleId input leading to SQL injection. No explicit remediation...

Macrob7 Macs Framework Cms SQL注入漏洞

Macrob7 Macs Framework Cms is an open source Cms framework from the personal developer Macdonald Terrence Robinson. version 1.14 of the Macrob7 Macs Framework Content Management System is vulnerable to SQL injection, which allows attackers to SQL injection can be performed via the "roleId"...

Cross site request forgery (csrf)

An issue was discovered in index.php in baijiacms V4 v41420170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser...

CVE-2018-10503

An issue was discovered in index.php in baijiacms V4 v41420170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser...

CVE-2018-10503: Cross-Site Request Forgery (CSRF)

An issue was discovered in index.php in baijiacms V4 v41420170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser...

Phpcms V9 uc api SQL注入漏洞

1.未启用ucenter服务的情况下uckey为空 define'UCKEY', pcbase::loadconfig'system', 'uckey'; 2. deleteuser接口存在SQL注入漏洞，UC算法加密的参数无惧GPC,程序员未意识到$get'ids'会存在SQL注入情况。 public function deleteuser$get,$post pcbase::loadappfunc'global', 'admin'; pcbase::loadappclass'messagequeue', 'admin' , 0; $ids =...

PeopleAggregator 1.2pre6-release-53 - Multiple Remote File Inclusions

PeopleAggregator 1.2pre6-release-53 - Multiple Remote File Inclusions PeopleAggregator 1.2pre6 Multiple Remote File Inclusion Vulnerabilities http://update.peopleaggregator.org/dist/peopleaggregator-1.2pre6-release-53.tar.gz DORK : "copyright 2006 Broadband Mechanics" POC :...

CVE-2006-4582

Cross-site request forgery CSRF vulnerability in The Address Book 1.04e allows remote attackers to perform unauthorized actions as other users via unspecified vectors, as demonstrated by deleting arbitrary users via the id parameter in a deleteuser action in users.php...

CVE-2006-4582: Undefined Security Weakness

Cross-site request forgery CSRF vulnerability in The Address Book 1.04e allows remote attackers to perform unauthorized actions as other users via unspecified vectors, as demonstrated by deleting arbitrary users via the id parameter in a deleteuser action in users.php...

Directory traversal

Directory traversal vulnerability in admin/deleteuser.php in HitHost 1.0.0 might allow remote attackers to delete directories possibly only empty directories via the $deleteuser variable. NOTE: the initial disclosure for this issue indicated that the researcher was unable to prove this issue;...

Cross site scripting

Cross-site scripting XSS vulnerability in HitHost 1.0.0 allows remote attackers to inject arbitrary web script or HTML via 1 the user parameter in deleteuser.php and 2 the hits parameter in viewuser.php...