CVE-2018-10265: Cross-Site Request Forgery (CSRF)

An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI...

PT-2018-9795

Name of the Vulnerable Software and Affected Versions: HongCMS version 3.0.0 Description: An issue was discovered that allows for a CSRF vulnerability, enabling the addition of an administrator account via the "admin/index.php/users/save" URI. Recommendations: For HongCMS version 3.0.0, update to...

PT-2017-6701

Name of the Vulnerable Software and Affected Versions qdPM version 8.3 Description The issue allows remote attackers to obtain sensitive information. This is achieved by providing an invalid ID value to the "index.php/users/info/id/ID" endpoint, which results in an error message that reveals the...

PT-2017-6702

Name of the Vulnerable Software and Affected Versions qdPM version 8.3 Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including the searchkeywords parameter to "index.php/users" page, the "Name of application" on...

CVE-2015-5075: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for requests that create an administrative account via a crafted request to index.php/users/create...

PT-2015-6768

Name of the Vulnerable Software and Affected Versions X2Engine X2CRM versions prior to 5.2 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that create an administrative account via a crafted request to...

CVE-2012-3840: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php/users/form/userid in MyClientBase 0.12 allow remote attackers to inject arbitrary web script or HTML via the 1 firstname or 2 lastname parameters...

PT-2012-5036

Name of the Vulnerable Software and Affected Versions MyClientBase version 0.12 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the first name or last name parameters in the...