CVE-2021-45914

In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator...

Online Sports Complex Booking System授权问题漏洞

Online Sports Complex Booking System is an online stadium booking system. version 1.0 of the Online Sports Complex Booking System is vulnerable to an authorization issue that could be exploited by attackers to take over a user's account via a specially crafted POST request...

PT-2022-12464 · Luxsoft · Luxcal Web Calendar

Name of the Vulnerable Software and Affected Versions: LuxSoft LuxCal Web Calendar versions prior to 5.2.0 Description: An unauthenticated attacker can manipulate a POST request, allowing the attacker's session to be authenticated as any registered LuxCal user, including the site administrator...

OrangeHRM Cross-Site Scripting Vulnerability (CNVD-2022-68518)

OrangeHRM is a human resource management system HRM from OrangeHRM USA. The system supports personnel information management, leave management, time and attendance management and recruitment management, etc. A cross-site scripting vulnerability exists in OrangeHRM v4.10.1, which stems from a lack...

CVE-2022-28992

A Cross-Site Request Forgery CSRF in Online Banquet Booking System v1.0 allows attackers to change admin credentials via a crafted POST request...

CVE-2022-28993

Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request...

CVE-2022-28993

Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request...

CVE-2022-28106

Online Sports Complex Booking System v1.0 was discovered to allow attackers to take over user accounts via a crafted POST request...

CVE-2022-28993

Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request...

CVE-2022-28992

A Cross-Site Request Forgery CSRF in Online Banquet Booking System v1.0 allows attackers to change admin credentials via a crafted POST request...

Cross site request forgery (csrf)

Online Sports Complex Booking System v1.0 was discovered to allow attackers to take over user accounts via a crafted POST request...

Cross site request forgery (csrf)

Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF in Online Banquet Booking System v1.0 allows attackers to change admin credentials via a crafted POST request...

CVE-2022-28993

The CVE-2022-28993 entry concerns Multi Store Inventory Management System v1.0 with an authorization issue that enables account takeover via a crafted POST request. Affected component is the web application’s access control logic; root cause is not explicitly detailed across sources, but multiple...

CVE-2022-28993

Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request...

CVE-2022-28992

A Cross-Site Request Forgery CSRF in Online Banquet Booking System v1.0 allows attackers to change admin credentials via a crafted POST request...

CVE-2022-28106

Online Sports Complex Booking System v1.0 was discovered to allow attackers to take over user accounts via a crafted POST request...

CVE-2022-28106

CVE-2022-28106 affects the Online Sports Complex Booking System v1.0. Public sources consistently describe an authorization flaw that lets an attacker take over a user account through a crafted POST request. The available documents do not provide explicit technical details on the affected compone...

CVE-2022-28987

Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request...