CVE-2026-35676

phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force immediate password changes by sendin...

CVE-2025-52289: Improper Privilege Management

A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilling/index.php/user/save to set their account status fom "pending" to "active" without requiring administrator approval...

CVE-2025-52289

A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilling/index.php/user/save to set their account status fom "pending" to "active" without requiring administrator approval...

CVE-2022-4228: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability classified as problematic has been found in SourceCodester Book Store Management System 1.0. This affects an unknown part of the file /bsmsci/index.php/user/edituser/. The manipulation of the argument password leads to information disclosure. It is possible to initiate the attack...

CVE-2021-45786

In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges...

CVE-2021-45786: Improper Authentication

In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges...

PT-2022-12406

Name of the Vulnerable Software and Affected Versions maccms version 10 Description The issue allows an attacker to gain privileges by logging in through the /index.php/user/login endpoint, specifically by exploiting the col and openid parameters. Recommendations For maccms version 10, consider...

CVE-2020-12282

iSmartgate PRO 1.5.9 is vulnerable to CSRF via the busca parameter in the form used for searching for users, accessible via /index.php. This can be combined with reflected XSS...

PT-2018-14909

Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A CSRF issue allows deletion of a user or group via specific URIs, such as "admin/index.php/user/del/1" or "admin/index.php/role/del/2". Recommendations For DiliCMS version 2.4.0, as a temporary workaround,...

CVE-2018-19291: Cross-Site Request Forgery (CSRF)

An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/role/del/2 URI...

Sql injection

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit parameter...

CVE-2018-16354: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit parameter...

PT-2018-13513

Name of the Vulnerable Software and Affected Versions FHCRM versions prior to 2018-02-11 Description An issue was discovered that allows SQL injection via the limit parameter in the "index.php/User/read" endpoint. Recommendations For versions prior to 2018-02-11, consider restricting access to th...

CVE-2018-7720: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability exists in Western Bridge Cobub Razor 0.7.2 via /index.php?/user/createNewUser/, resulting in account creation...

PT-2018-18234

Name of the Vulnerable Software and Affected Versions: Western Bridge Cobub Razor version 0.7.2 Description: A cross-site request forgery issue exists, allowing for account creation via the "/index.php?/user/createNewUser/" endpoint. Recommendations: For version 0.7.2, consider restricting access...

CVE-2017-17994: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competencycriteria request...

CVE-2017-17993: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=additiondeduction request...

CVE-2017-17991: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the expensename parameter in an index.php?user=expenses request...

PT-2017-15147

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the lack of proper validation of user input in the...

PT-2017-15150

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved through the criteria parameter in a specific request...