CVE-2024-57160: Cross-Site Request Forgery (CSRF)

07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery CSRF via /erp.07fly.net:80/oa/OaTask/edit.html...

CVE-2024-57161: Cross-Site Request Forgery (CSRF)

07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery CSRF via /erp.07fly.net:80/oa/OaWorkReport/edit.html...

PT-2021-11887

Name of the Vulnerable Software and Affected Versions: YzmCMS version 5.8 Description: A storage XSS issue allows attackers to inject JS code, enabling malicious XSS attacks on the "/admin/system manage/user config edit.html" API endpoint. This can be exploited to execute unauthorized actions...

Msvod 10 Cross Site Request Forgery

Exploit Title: Msvod v10 has a CSRF vulnerability to change user information Date: 2019-04-14 Exploit Author: ax8 Vendor Homepage: https://github.com/Li-Siyuan Software Link: https://www.msvodx.com/ Version: v10 CVE : CVE-2019-11375 Msvod v10 has a CSRF vulnerability to change user information vi...

Msvod 10 - Cross-Site Request Forgery (Change User Information) Exploit

Exploit for php platform in category web applications Exploit Title: Msvod v10 has a CSRF vulnerability to change user information Exploit Author: ax8 Vendor Homepage: https://github.com/Li-Siyuan Software Link: https://www.msvodx.com/ Version: v10 CVE : CVE-2019-11375 Msvod v10 has a CSRF...

CVE-2019-11375

CVE-2019-11375 affects Msvod v10 and describes a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to change user information via the URI /admin/member/edit.html. The Red Hat, ENISA EUVD, Exploit-DB, PacketStorm, and related entries corroborate the core issue: a CSRF flaw en...

CVE-2019-11375: Cross-Site Request Forgery (CSRF)

Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI...

PT-2019-12266

Name of the Vulnerable Software and Affected Versions Msvod version 10 Description The issue allows an attacker to change user information via the "admin/member/edit.html" API endpoint. This is achieved through a CSRF vulnerability, which can be exploited to modify user data without the user's...

CVE-2019-9660

Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html "catname" parameter...

CVE-2019-9660: Improper Neutralization of Input During Web Page Generation

Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html "catname" parameter...

PT-2019-19784

Name of the Vulnerable Software and Affected Versions YzmCMS version 5.2 Description A stored XSS issue exists, allowing potential exploitation via the catname parameter in the admin/category/edit.html page. Recommendations For YzmCMS version 5.2, update the software to a version that includes a...

PT-2019-19785

Name of the Vulnerable Software and Affected Versions YzmCMS version 5.2 Description A stored XSS issue exists, allowing potential exploitation via the value parameter in the "admin/system manage/user config edit.html" API endpoint. Recommendations For YzmCMS version 5.2, consider restricting...

CVE-2018-8078

YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html...

CVE-2018-8078

CVE-2018-8078 affects YzmCMS 3.7, where a Stored XSS vulnerability exists in the title parameter of advertisement/adver/edit.html. The root cause is unescaped user input in the title field, enabling arbitrary script/HTML injection. Documented impact is XSS with low to medium severity depending on...

PT-2018-18422

Name of the Vulnerable Software and Affected Versions: YzmCMS version 3.7 Description: The issue is related to Stored XSS, which occurs via the title parameter to the "advertisement/adver/edit.html" endpoint. Recommendations: For YzmCMS version 3.7, update the software to a version that includes ...

CVE-2018-8078: Improper Neutralization of Input During Web Page Generation

YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html...

PT-2018-17958

Name of the Vulnerable Software and Affected Versions NoneCms version 1.3.0 Description The issue allows for CSRF attacks, which can be used to perform actions such as changing an admin password or adding an account. This can be achieved by sending a request to the...