PT-2020-20433

Name of the Vulnerable Software and Affected Versions LiteCart versions prior to 2.2.2 Description The issue allows for a CSRF attack via the "admin/?app=users&doc=edit user" endpoint to add a user. Recommendations For versions prior to 2.2.2, update to version 2.2.2 or later to resolve the issue...

Online Job Portal 1.0 - Cross Site Request Forgery (Add User)

Exploit Title: Online Job Portal 1.0 - Cross Site Request Forgery Add User Dork: N/A Date: 2020-02-06 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/php/13850/online-job-portal-phppdo.html Software Link:...

Online Job Portal 1.0 Cross Site Request Forgery

Exploit Title: Online Job Portal 1.0 - Cross Site Request Forgery Add User Dork: N/A Date: 2020-02-06 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/php/13850/online-job-portal-phppdo.html Software Link:...

CMSsite 1.0 Cross Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: CMSsite 1.0 - Cross-Site Request Forgery Delete Admin Exploit Author: Mr Winst0n Author E-mail: [email protected] Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link :...

School Attendance Monitoring System Cross-Site Request Forgery Vulnerability (CNVD-2019-00825)

School Attendance Monitoring System is a school attendance monitoring system. A cross-site request forgery vulnerability exists in School Attendance Monitoring System version 1.0, which can be exploited by remote attackers to update administrator information via the /user/user/edit.php file...

Fiyo CMS Cross-Site Scripting Vulnerability (CNVD-2018-21626)

Fiyo CMS is a content management system CMS for creating CMS templates. A cross-site scripting vulnerability exists in the dapur\apps\appuser\edituser.php page in Fiyo CMS version 2.0.7. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the 'name'...

CVE-2018-18545

Fiyo CMS 2.0.7 has XSS via the dapur\apps\appuser\edituser.php name parameter...

PT-2018-10593

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns a session management problem in the Administrations Tab of Monstra CMS. Specifically, changing a password at the "admin/index.php?id=users&action=edit&user id=1" endpoint does not...

Monstra CMS 3.0.4 Cross Site Scripting

Exploit Title: Stored XSS at Monstra CMS 3.0.4 Install Page Date: 20.05.2018 Exploit Author: Ismail Tasdelen Vendor Homepage: http://monstra.org/ Software Link: Monstra CMS Version: Monstra CMS 3.0.4 Tested on: Windows 10 / Debian - XAMMP Web Server PoC : https://www.youtube.com/watch?v=AQweKapFz...

CVE-2018-10503

An issue was discovered in index.php in baijiacms V4 v41420170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser...

baijiacms Cross-Site Request Forgery Vulnerability

baijiacms is a content management system CMS for e-commerce. A cross-site request forgery vulnerability exists in baijiacms version 3. A remote attacker can add an administrator account with index.php?mod=site&op=edituser&name=manager&do=user to exploit this vulnerability...

Code injection

ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows access to various /UserManagement/ privileged modules without authenticating the user; an attacker can misuse these functionalities to perform unauthorized actions, as demonstrated by Edit User Details...

CVE-2018-5328

ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows access to various /UserManagement/ privileged modules without authenticating the user; an attacker can misuse these functionalities to perform unauthorized actions, as demonstrated by Edit User Details...

CVE-2018-5328

ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows access to various /UserManagement/ privileged modules without authenticating the user; an attacker can misuse these functionalities to perform unauthorized actions, as demonstrated by Edit User Details...

CVE-2018-5328: Improper Authentication

ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows access to various /UserManagement/ privileged modules without authenticating the user; an attacker can misuse these functionalities to perform unauthorized actions, as demonstrated by Edit User Details...

TeamPass users.series.php Access Control Vulnerability

TeamPass is a dedicated password manager for Apache, MySQL and PHP. An access control vulnerability exists in versions prior to TeamPass 2.1.27.9 that stems from the program failing to properly enforce administrator access control. An attacker can exploit this vulnerability by obtaining...

phpwcms Cross-Site Scripting Vulnerability

phpwcms is a flexible, fast, robust, customer and developer friendly and powerful web-based content management system and cms framework based on PHP and MySQL. A cross-site scripting vulnerability exists in include/inctmpl/admin.edituser.tmpl.php and include/inctmpl/admin.newuser.tmpl.php in...

CVE-2017-14973

IDenticard Two-Reader Controller Configuration Manager 1.18.8 396 is vulnerable to Stored Cross-Site Scripting XSS via the notes field in /userhandler?file=loggedin.shtm aka the edit user page...

CVE-2017-14973

IDenticard Two-Reader Controller Configuration Manager 1.18.8 396 is vulnerable to Stored Cross-Site Scripting XSS via the notes field in /userhandler?file=loggedin.shtm aka the edit user page...

CVE-2017-14973: Improper Neutralization of Input During Web Page Generation

IDenticard Two-Reader Controller Configuration Manager 1.18.8 396 is vulnerable to Stored Cross-Site Scripting XSS via the notes field in /userhandler?file=loggedin.shtm aka the edit user page...