eph-stockstadt.de Improper Access Control vulnerability OBB-3767124

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2009-4385

CVE-2009-4385 describes multiple CSRF vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH). Attackers can hijack user authentication to perform delete_poll (index.php) and administrator authentication to delete users (admin.php) or send arbitrary email (admin.php). The affected components are th...

CVE-2009-4384

CVE-2009-4384 affects Scriptsez.net Ez Poll Hoster (EPH). The vulnerabilities are cross-site scripting (XSS) via two parameters: the pid parameter in a code action to index.php and the uid parameter in a view action to profile.php. Root cause: insufficient input validation allowing injection of a...