CVE-2025-52289: Improper Privilege Management

A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilling/index.php/user/save to set their account status fom "pending" to "active" without requiring administrator approval...

CVE-2025-52289

A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilling/index.php/user/save to set their account status fom "pending" to "active" without requiring administrator approval...

CVE-2022-4228: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability classified as problematic has been found in SourceCodester Book Store Management System 1.0. This affects an unknown part of the file /bsmsci/index.php/user/edituser/. The manipulation of the argument password leads to information disclosure. It is possible to initiate the attack...

CVE-2021-45786

In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges...

CVE-2021-45786: Improper Authentication

In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges...

PT-2022-12406

Name of the Vulnerable Software and Affected Versions maccms version 10 Description The issue allows an attacker to gain privileges by logging in through the /index.php/user/login endpoint, specifically by exploiting the col and openid parameters. Recommendations For maccms version 10, consider...

CVE-2020-12282

iSmartgate PRO 1.5.9 is vulnerable to CSRF via the busca parameter in the form used for searching for users, accessible via /index.php. This can be combined with reflected XSS...

PT-2018-14909

Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A CSRF issue allows deletion of a user or group via specific URIs, such as "admin/index.php/user/del/1" or "admin/index.php/role/del/2". Recommendations For DiliCMS version 2.4.0, as a temporary workaround,...

CVE-2018-19291: Cross-Site Request Forgery (CSRF)

An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/role/del/2 URI...

Sql injection

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit parameter...

PT-2018-13513

Name of the Vulnerable Software and Affected Versions FHCRM versions prior to 2018-02-11 Description An issue was discovered that allows SQL injection via the limit parameter in the "index.php/User/read" endpoint. Recommendations For versions prior to 2018-02-11, consider restricting access to th...

CVE-2018-16354: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit parameter...

CVE-2018-7720: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability exists in Western Bridge Cobub Razor 0.7.2 via /index.php?/user/createNewUser/, resulting in account creation...

PT-2018-18234

Name of the Vulnerable Software and Affected Versions: Western Bridge Cobub Razor version 0.7.2 Description: A cross-site request forgery issue exists, allowing for account creation via the "/index.php?/user/createNewUser/" endpoint. Recommendations: For version 0.7.2, consider restricting access...

PT-2017-15149

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the lack of proper validation of user input in the...

PT-2017-15147

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the lack of proper validation of user input in the...

PT-2017-15151

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the lack of proper input validation in the Last Name...

PT-2017-15150

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved through the criteria parameter in a specific request...

CVE-2017-17995: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the LastName parameter in an index.php?user=ajax request...

CVE-2017-17993: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=additiondeduction request...