32 matches found
CVE-2017-17991: Improper Neutralization of Input During Web Page Generation
Biometric Shift Employee Management System has XSS via the expensename parameter in an index.php?user=expenses request...
CVE-2017-17994: Improper Neutralization of Input During Web Page Generation
Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competencycriteria request...
CVE-2017-9673
In SimpleCE 2.3.0, a CSRF vulnerability can be exploited to add an administrator account via the index.php/user/new URI or change its settings via the index.php/user/1 URI, including its password...
PT-2017-19108
Name of the Vulnerable Software and Affected Versions SimpleCE version 2.3.0 Description A CSRF issue can be exploited to add an administrator account or change its settings, including the password, by accessing specific API endpoints such as "index.php/user/new" or "index.php/user/1"...
CVE-2017-9673: Cross-Site Request Forgery (CSRF)
In SimpleCE 2.3.0, a CSRF vulnerability can be exploited to add an administrator account via the index.php/user/new URI or change its settings via the index.php/user/1 URI, including its password...
PT-2015-3632
Name of the Vulnerable Software and Affected Versions Savsoft Quiz affected versions not specified Description A cross-site request forgery CSRF issue exists in the index.php/user data/insert user endpoint, allowing remote attackers to hijack administrator authentication for requests that create...
Open redirect
Open redirect vulnerability in YOOtheme Pagekit CMS 0.8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to index.php/user/logout...
PT-2014-8393
Name of the Vulnerable Software and Affected Versions YOOtheme Pagekit CMS version 0.8.7 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. This can be achieved via the HTTP Referer...
CVE-2014-8070: Undefined Security Weakness
Open redirect vulnerability in YOOtheme Pagekit CMS 0.8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to index.php/user/logout...
PT-2014-2588
Name of the Vulnerable Software and Affected Versions SimpleHRM versions 2.3, 2.2, and earlier Description The issue allows remote attackers to execute arbitrary SQL commands via the username parameter to "index.php/user/setLogin". This is a SQL injection vulnerability in the login page,...
CVE-2013-2498: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the login page in flexycms/modules/user/usermanager.php in SimpleHRM 2.3, 2.2, and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter to index.php/user/setLogin...
