CVE-2020-27575

Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability. The web administration contains functionality in which administrators are able to manage users. The edit users form contains a parameter vulnerable to command injection due to insufficient validation...

Maxum Rumpus 命令注入漏洞

Maxum Rumpus is an FTP and Web file transfer server. A command injection vulnerability exists in a parameter of the Edit User form in Maxum Rumpus 8.2.13, 8.2.14, which can be exploited by an attacker to inject arbitrary commands...

Easy2Pilot 7 - Cross-Site Request Forgery (Add User)

Easy2Pilot 7 - Cross-Site Request Forgery Add User Exploit Title: Easy2Pilot 7 - Cross-Site Request Forgery Add User Author: indoushka Date: 2020-02-20 Tested on: windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit Vendor: http://easy2pilot-v7.com/ CVE: N/A poc : + Dorking İn Google ...

CVE-2016-10732

ProjectSend formerly cFTP r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?fileid=1, or process-zip-download.php, or adduserform parameters to users-add.php...

Ed: DOM XSS in edoverflow.com/tools/respond due to unsafe usage of the innerHTML property.

Hi, There's a DOM XSS vulnerability on edoverflow.com. This cannot be exploited without user-interaction so I had to make a clickjacking PoC to trick the user in triggering the payload her/himself. Reproduction Steps 1. Open the attached HTML document in FireFox. 2. Drag Frog 1 to the other two...

Websites Grabbing User-Form Data Before It's Submitted

Websites are sending information prematurely: ...we discovered NaviStone's code on sites run by Acurian, Quicken Loans, a continuing education center, a clothing store for plus-sized women, and a host of other retailers. Using Javascript, those sites were transmitting information from people as...

GLPI Elevation of Privilege Vulnerability

GLPI is an open source IT resource management suite maintained by the Indepnet Association. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A security vulnerability exists in GLPI 0.85.2 and earlier versions. The...

UBUNTU-CVE-2015-7685

GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the profilesid parameter to front/user.form.php...

CVE-2014-8073

CVE-2014-8073 describes a CSRF vulnerability in OpenMRS 2.1 Standalone Edition. The issue allows remote attackers to hijack the authentication of administrators to perform a privileged action: adding a new user through the admin/users/user.form Save User flow. The connected OpenVAS entry also ref...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in login.php in myPHPscripts Login Session 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 lsuser and 2 lsemail parameters aka the User form in an lsregister action. NOTE: some of these details are obtained from third...

CVE-2008-5854

Multiple cross-site scripting XSS vulnerabilities in login.php in myPHPscripts Login Session 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 lsuser and 2 lsemail parameters aka the User form in an lsregister action. NOTE: some of these details are obtained from third...

myPHPscripts Login Session 2.0 - Cross-Site Scripting Database Disclosure

myPHPscripts Login Session 2.0 - Cross-Site Scripting Database Disclosure START 0x01 Informations: Script : myPHPscripts Login Session 2.0 Download : http://www.hotscripts.com/jump.php?listingid=69881&jumptype=1 Vulnerability : XSS / Database Disclosure Author : Osirys Contact : osirysatlivedotit...

PYSEC-2008-12

The user form processing userform.py in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges...

CVE-2008-1937

The user form processing userform.py in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges...

CVE-2008-1937

The user form processing userform.py in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges...

MoinMoin 1.5.x - 'MOIND_ID' Cookie Login Bypass

!/usr/bin/python Exploit for the MOINDID cookie Bug MoinMoin 1.5.x Find your patch in : http://hg.moinmo.in/moin/1.5/rev/e69a16b6e630 Bug and exploit coded by just a nonroot and colombian user Enero 21 de 2008 Greets: el directorio and all the SL community import urllib2,sys print "MoinMoin host:...

AGTC-Membership system v1.1a (adduser) Remote Add Admin Exploit

!-- - Product : AGTC-Membership system - Version : 1.1a - Website : http://www.agtc.co.uk - Author : 0x90 - HomePage : WwW.0x90.CoM.Ar - Contact : Gunsat0x90dotcomdotar - Problem : Admin Added Access. -- form name="form1" method="post" action="http://target/adduser.php" h3...