Monstra-Dev 3.0.4 - Cross-Site Request Forgery (Account Hijacking)

Exploit Title: Monstra-Dev 3.0.4 - Cross-Site Request ForgeryAccount Hijacking Date: 2018-08-04 Exploit Author: Nainsi Gupta Vendor Homepage: http://monstra.org/ Product Name: Monstra-dev Version: 3.0.4 Tested on: Windows 10 Firefox/Chrome CVE : N/A 1. Description CSRF vulnerability in...

ekobroucek.cz Cross Site Request Forgery vulnerability

Open Bug Bounty ID: OBB-656150 Description| Value ---|--- Affected Website:| ekobroucek.cz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| CSRF Cross-Site Request Forgery / CWE-352 CVSSv3 Score:| 8.8...

rondony.cz Cross Site Request Forgery vulnerability

Open Bug Bounty ID: OBB-655177 Description| Value ---|--- Affected Website:| rondony.cz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| CSRF Cross-Site Request Forgery / CWE-352 CVSSv3 Score:| 8.8...

Cross site request forgery (csrf)

CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account, as demonstrated by modifying the account's email field...

CVE-2018-14029

CVE-2018-14029 : CSRF in the WityCMS 0.6.2 admin/user/edit flow allows an attacker to take over a user account by modifying user data (e.g., email, password). The vulnerability stems from cross-site request forgery in the admin interface, with CVSSv3 base score 8.8 (HIGH) and user interaction req...

PT-2018-4118 · Manageiq +1 · Manageiq +1

Name of the Vulnerable Software and Affected Versions: ManageIQ affected versions not specified Red Hat CloudForms Management Engine CFME affected versions not specified Description: The issue allows remote authenticated users to bypass authorization and gain privileges. This is due to improper...

CVE-2017-17904

FS Lynda Clone has XSS via the keywords parameter to tutorial/ or the editprofilefirstname parameter to user/editprofile...

CVE-2017-17903

FS Lynda Clone has CSRF via user/editprofile, as demonstrated by adding content to the user panel...

FS Lynda Clone Cross-Site Request Forgery Vulnerability

FS Lynda Clone is a video tutorial software developed with jQuery, PHP and MySQL. FS Lynda Clone suffers from a cross-site request forgery vulnerability. An attacker can exploit this vulnerability to conduct cross-site request forgery attacks via user/editprofile...

Xavier PHP Management Panel SQL Injection Vulnerability

Xavier PHP Management Panel is a PHP-based web content protection script. A SQL injection vulnerability exists in Xavier PHP Management Panel version 2.4. A remote attacker can inject malicious SQL commands into the admin/adminuseredit.php file by sending the 'usertoedit' parameter or the...

CVE-2017-15949

Xavier PHP Management Panel 2.4 allows SQL injection via the usertoedit parameter to admin/adminuseredit.php or the logid parameter to admin/editgroup.php...

WordPress 2.9.2-4.8.1 - Open Redirect

Description An open redirect was discovered on the user and term edit screens. Reported by Yasin Soliman ysx...

DEBIAN-CVE-2017-14725

Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php...

WordPress <=4.8.1 - Open redirect vulnerability (user and term edit screens)

Open redirect vulnerability found by Yasin Soliman ysx in WordPress user and term edit screens version 4.8.1 and earlier versions. Solution Update the WordPress to the latest available version at least 4.8.2...

Cross-Site Scripting (XSS)

craftcms/cms is susceptible to cross-site scripting XSS attacks. These attacks exist because the application displays the first name, last name and user name on the user index and user edit pages without properly encoding them...

Ignite Realtime Openfire Elevation of Privilege Vulnerability

Ignite Realtime Openfire formerly known as Wildfire is the IgniteRealtime community of a Java development and based on XMPP formerly known as Jabber, Instant Messaging Protocol cross-platform open-source real-time collaboration RTC server , it can build a high-efficiency instant messaging servers...

Code injection

Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp...

Suning a backstage bypass arbitrary file upload-vulnerability warning-the black bar safety net

http://58.213.19.68/users/signin Suning Plaza phone the client back-end management system http://58.213.19.68/users/signup you can register for an account Then login ! Snip2015010713. png Point into the background is not entitled to limit access, but the system using rb to develop The error...

CFME: check_privileges logic error resulting in privilege escalation

The checkprivileges method in vmdb/app/controllers/applicationcontroller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine CFME, allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbacuseredit action...

SyndeoCMS <= 3.0.01 Persistent XSS Vulnerability

Exploit for php platform in category web applications +---------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : SyndeoCMS = 3.0.01 Persistent XSS Date : 29-03-2012 Author : Ivano Binetti...