Cross site request forgery (csrf)

The Cimy Header Image Rotator WordPress plugin through 6.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1885 Cimy Header Image Rotator <= 6.1.1 - Arbitrary Settings Update via CSRF

The Cimy Header Image Rotator WordPress plugin through 6.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1885

CVE-2022-1885 affects the Cimy Header Image Rotator WordPress plugin up to version 6.1.1. The root cause is missing CSRF protection when updating settings, enabling an attacker to induce a logged-in admin to change configurations via CSRF. Multiple sources (NVD/Red Hat/CVE lists and WPScan/WP vul...

Hucart CMS SQL注入漏洞

HuCart HuCart is an open source enterprise website building system. HuCartCMS version 5.7.4 has a SQL injection vulnerability in the header usdimage field. An attacker can use this vulnerability to launch SQL injection attacks...

WordPress Plugin Wp Unique Article Header Image Has Multiple Cross-Site Request Forgery Vulnerabilities

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.Wp Unique Article Header Image plugin is a plugin used to add article header images. The wordPress plugin Wp Unique...

CVE-2014-9400

Multiple cross-site request forgery CSRF vulnerabilities in the Wp Unique Article Header Image plugin 1.0 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 gtdefaultheader or 2...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Wp Unique Article Header Image plugin 1.0 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 gtdefaultheader or 2...

CVE-2014-9400

CVE-2014-9400 concerns the WordPress plugin “WP Unique Article Header Image” (version 1.0 and earlier). The connected sources confirm CSRF vulnerabilities that allow an attacker to hijack an administrator’s authentication for requests leading to cross-site scripting (XSS) via the parameters gt_de...

WordPress Wp Unique Article Header Image Plugin <= 1.0 - Multiple CSRF and XSS

Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution There is no solution, because plugin is...

WordPress 3.3.1 - Multiple Cross-Site Request Forgery Vulnerabilities

WordPress 3.3.1 - Multiple Cross-Site Request Forgery Vulnerabilities +---------------------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Wordpress 3.3.1 Multiple CSRF Vulnerabilities Date : 19-03-20...

Design/Logic Flaw

Unspecified vulnerability in the Header Image Module before 5.x-1.1 for Drupal allows remote attackers to access the administration pages via unknown attack vectors...

CVE-2008-0823

Unspecified vulnerability in the Header Image Module before 5.x-1.1 for Drupal allows remote attackers to access the administration pages via unknown attack vectors...

CVE-2008-0823

Technical details are not publicly provided in the supplied documents for CVE-2008-0823; monitor for updates.

CVE-2008-0823

Unspecified vulnerability in the Header Image Module before 5.x-1.1 for Drupal allows remote attackers to access the administration pages via unknown attack vectors...

SA-2008-017 - Header image - Access bypass

The Header image module allows sites to display an image on selected pages based on the node id, path, taxonomy, node type, containing book or the result of PHP code. The module contains a vulnerability where access to the module's administration pages is granted to any user, including the...