CVE-2024-57523

Cross Site Request Forgery CSRF in Users.php in SourceCodester Packers and Movers Management System 1.0 allows attackers to create unauthorized admin accounts via crafted requests sent to an authenticated admin user...

PT-2025-5854 · Sourcecodester · Sourcecodester Packers/Movers Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Packers and Movers Management System version 1.0 Description: The issue allows attackers to create unauthorized admin accounts via crafted requests sent to an authenticated admin user. This is due to a Cross Site Request Forger...

CVE-2024-57523

Cross Site Request Forgery CSRF in Users.php in SourceCodester Packers and Movers Management System 1.0 allows attackers to create unauthorized admin accounts via crafted requests sent to an authenticated admin user...

CVE-2024-57523

Cross Site Request Forgery CSRF in Users.php in SourceCodester Packers and Movers Management System 1.0 allows attackers to create unauthorized admin accounts via crafted requests sent to an authenticated admin user...

CVE-2024-57523

CVE-2024-57523 corresponds to a CSRF vulnerability in the Users.php endpoint of SourceCodester Packers and Movers Management System 1.0. Exploitation requires an authenticated admin user to visit a crafted page, enabling attackers to create unauthorized admin accounts (privilege escalation) with ...

Exploit for Cross-Site Request Forgery (CSRF) in Oretnom23 Packers_And_Movers_Management_System

CVE-2024-57523 - CSRF Vulnerability in Users.php - SourceCodes...

Fortra GoAnywhere Managed File Transfer (MFT) < 7.4.2 Path Traversal (CVE-2024-25156)

According to its self-reported version, the instance of Fortra GoAnywhere Managed File Transfer MFT running on the remote web server is 7.4.2. It is, therefore, affected by an Path Traversal vulnerability. This can allow an unauthenticated attacker to create an admin user via the administration...

Vulnerabilities fixed in Ivanti Connect Secure and Policy Secure

Ivanti has fixed vulnerabilities in Connect Secure and Policy Secure. A malicious party could exploit the vulnerabilities to launch attacks that could result in the following categories of damage: Denial-of-Service DoS Cross-Site Scripting XSS. Increased user privileges Remote code execution User...

PT-2024-34616 · Jatos · Jatos

Name of the Vulnerable Software and Affected Versions: JATOS version 3.9.3 Description: A Cross-Site Request Forgery CSRF issue allows attackers to perform actions reserved for administrators, including creating admin accounts. This flaw can lead to unauthorized activities, compromising the...

WordPress plugin WP Extended 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-5784

The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on multiple functions like treportquizatttemptdelete and tutorgcclassaction in all versions up to, and including, 2.7.2. This makes it possible for authenticate...

PT-2025-54259

Name of the Vulnerable Software and Affected Versions Ksenia Security Lares 4.0 Home Automation version 1.6 Description Ksenia Security Lares 4.0 Home Automation version 1.6 has a default credentials issue that allows unauthorized access to administrative functions. Successful exploitation grants...

Hanwha Techwin SRN-4000 Improper Access Control (CVE-2017-7912)

A security research organization has discovered and disclosed a critical vulnerability in the firmware of certain Hanwha network video recording NVR devices. A specially crafted http request and response could allow an attacker to gain access to the device management page with admin privileges...

CVE-2024-35433

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the permissions of managing users, can create a new admin user...

CVE-2024-23576

Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations...

PT-2024-19944 · Hcl · Hcl Commerce

Name of the Vulnerable Software and Affected Versions: HCL Commerce versions 9.1.12 through 9.1.13 Description: The issue allows for denial of service, disclosure of user personal data, and performing of unauthorized administrative operations. Recommendations: For versions 9.1.12 and 9.1.13, at t...

PT-2023-31252 · Unknown · Book Store Management System

Name of the Vulnerable Software and Affected Versions: Book Store Management System version v1 Description: The issue allows attackers to access unauthorized pages and execute administrative functions without authenticating, due to incorrect access control. Recommendations: For Book Store...

CVE-2023-47629

DataHub is an open-source metadata platform. In affected versions sign-up through an invite link does not properly restrict users from signing up as privileged accounts. If a user is given an email sign-up link they can potentially create an admin account given certain preconditions. If the defau...

Exploit for Improper Input Validation in Atlassian Confluence_Data_Center

RedTeamTool-CVE-2023-22515 – Vulnerability Exploitation Tool...

CVE-2023-22515

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access...