58 matches found
PT-2025-47308
Name of the Vulnerable Software and Affected Versions Windu CMS version 4.1 Windu CMS affected versions not specified Description Windu CMS has a flaw that allows attackers to perform Cross-Site Request Forgery CSRF attacks in the user editing functionality. The existing CSRF protection can be...
CVE-2025-59112: Cross-Site Request Forgery (CSRF)
Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send POST request that deletes given user. Only version 4.1 was tested and confirmed as vulnerable. This issue wa...
CVE-2025-59111: Incorrect Authorization
Windu CMS is vulnerable to Broken Access Control in user editing functionality. Malicious attacker can send a GET request which allows privileged users to delete Super Admins which is not possible with GUI. Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4...
CVE-2025-59110: Cross-Site Request Forgery (CSRF)
Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Implemented CSRF protection mechanism can be bypassed by using CSRF token of other user. It is worth noting that the registration is open and anyone can create an account. Only version 4.1 was tested and confirme...
EUVD-2021-0800
Malware in sbrugna...
EUVD-2022-28403
Malicious code in bioql PyPI...
EUVD-2022-3929
Malicious code in bioql PyPI...
CVE-2025-7928
A vulnerability was found in code-projects Church Donation System 1.0 and classified as critical. This issue affects some unknown processing of the file /members/edituser.php. The manipulation of the argument firstname leads to sql injection. The attack may be initiated remotely. The exploit has...
CVE-2012-4475
The Security Questions module for Drupal 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.1 does not properly restrict access, which allows remote attackers to edit an arbitrary user's questions and answers via unspecified vectors...
CVE-2024-38503 Apache Syncope: HTML tags can be injected into Console or Enduser text fields
When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are recommended to upgrade to...
Stored XSS via user's Username
Description The application allows creating users with Username containing Malicious HTML/Javascript that can be executed in the users’ privileged context during the user editing process or visiting a phishing link. Proof of Concept Step 1: A privileged user creates a normal user account with...
CVE-2023-24724: Improper Neutralization of Input During Web Page Generation
A stored cross site scripting XSS vulnerability was discovered in the user management module of the SAS 9.4 Admin Console, due to insufficient validation and sanitization of data input into the user creation and editing form fields. The product name is SAS Web Administration interface SASAdmin. F...
CVE-2022-23321
A persistent cross-site scripting XSS vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore application on version 12.3.7244.0...
PT-2022-15929 · Xmpie · Xmpie Ustore
Name of the Vulnerable Software and Affected Versions: XMPie UStore version 12.3.7244.0 Description: A persistent cross-site scripting XSS issue exists in the administrative panel when editing users, specifically affecting two input fields. Recommendations: For version 12.3.7244.0, consider...
CVE-2022-23321: Improper Neutralization of Input During Web Page Generation
A persistent cross-site scripting XSS vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore application on version 12.3.7244.0...
XMPie UStore 跨站脚本漏洞
Xmpie Ustore is a network printing solution from Xmpie USA. A security vulnerability exists in the XMPie UStore application that stems from a persistent cross-site scripting XSS vulnerability in two input fields in the admin panel when editing a user in the XMPie UStore application, version...
Any logged in user could edit any other logged in user.
Impact Everyone who is running a12n-server. A new HAL-Form was added to allow editing users. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change. Patches Patched in v0.18.2...
CVE-2021-29452 Any logged in user could edit any other logged in user.
a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make th...
CVE-2021-29452
CVE-2021-29452 : A flawed privilege check in the a12n-server HAL-Form for editing users (v0.18.0) allowed any logged-in user to edit other users. Patched in v0.18.2. Multiple connected advisories corroborate insecure access controls affecting all users of the package; remediation is upgrade to th...
