CVE-2023-37596

CVE-2023-37596 — issabel-pbx 4.0.0-6: Cross-Site Request Forgery CSRF — Delete Any User Severity: High | CVSS v3.1: 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H | CWE: CWE-352 Table of Contents Overview Vulnerability Details Impact Affected Version Attack Scenario Proof of Concept Steps to Reproduce...

CVE-2026-10236

A vulnerability has been found in SourceCodester Water Billing Management System 1.0. This issue affects some unknown processing of the file /classes/Users.php?f=save of the component User Management Endpoint. Such manipulation leads to improper authorization. The attack may be launched remotely...

CVE-2026-10236

A vulnerability has been found in SourceCodester Water Billing Management System 1.0. This issue affects some unknown processing of the file /classes/Users.php?f=save of the component User Management Endpoint. Such manipulation leads to improper authorization. The attack may be launched remotely...

PT-2026-45346

Name of the Vulnerable Software and Affected Versions SourceCodester Water Billing Management System version 1.0 Description Improper authorization occurs due to the processing of the '/classes/Users.php?f=save' endpoint within the User Management Endpoint component. This issue allows a remote...

CVE-2026-10236: Improper Authorization

A vulnerability has been found in SourceCodester Water Billing Management System 1.0. This issue affects some unknown processing of the file /classes/Users.php?f=save of the component User Management Endpoint. Such manipulation leads to improper authorization. The attack may be launched remotely...

SourceCodester Water Billing Management System 授权问题漏洞

The SourceCodester Water Billing Management System is an open-source water billing management system developed by SourceCodester. Version 1.0 of the SourceCodester Water Billing Management System has a vulnerability related to authorization issues. This vulnerability stems from a problem with the...

EUVD-2018-21919

PHP-SHOP 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to add administrative users by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that automatically submits POST...

CVE-2026-2076

A weakness has been identified in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected by this vulnerability is the function addUser/updateUser/deleteUser of the file dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\UserController.java of the component User...

CVE-2026-2076

A weakness has been identified in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected by this vulnerability is the function addUser/updateUser/deleteUser of the file dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\UserController.java of the component User...

CVE-2026-2076: Improper Authorization

A weakness has been identified in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected by this vulnerability is the function addUser/updateUser/deleteUser of the file dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\UserController.java of the component User...

warehouse 授权问题漏洞

Warehouse is a small-scale warehouse logistics management system developed by Yeqifu, based on Spring Boot. Versions of Warehouse such as aaf29962ba407d22d991781de28796ee7b4670e4 and earlier versions have authorization-related vulnerabilities. These vulnerabilities stem from improper authorizatio...

CVE-2019-25237

V-SOL GPON/EPON OLT Platform v2.03 contains a privilege escalation vulnerability that allows normal users to gain administrative access by manipulating the user role parameter. Attackers can send a crafted HTTP POST request to the user management endpoint with 'userrolemod' set to integer value '...

CVE-2019-25237

Summary: CVE-2019-25237 affects the V-SOL GPON/EPON OLT Platform v2.03, enabling privilege escalation by manipulating the user_role_mod (or similar) parameter via a crafted HTTP POST to the user management endpoint, allowing normal users to gain administrative access. The incident is supported by...

PT-2025-53323

V-SOL GPON/EPON OLT Platform v2.03 contains a privilege escalation vulnerability that allows normal users to gain administrative access by manipulating the user role parameter. Attackers can send a crafted HTTP POST request to the user management endpoint with 'user role mod' set to integer value...

CVE-2023-53775 Screen SFT DAB 1.9.3 Authentication Bypass via Session Management Weakness

Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change user passwords by exploiting weak session management controls. Attackers can reuse IP-bound session identifiers to issue unauthorized requests to the userManager API and modify user credentials...

CVE-2020-36901 UBICOD Medivision Digital Signage 1.5.1 Cross-Site Request Forgery via User Management

UBICOD Medivision Digital Signage 1.5.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation. Attackers can craft a malicious web page that submits a form to the /query/user/itSet endpoint to add a new...

PT-2025-48071

Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests. Specifically, a standard user can exploit this flaw by sending direct HTTP requests to administrative endpoints, bypassing the UI restrictions. This allows the attacker to manipulate...

CVE-2025-63226

The Sencore SMP100 SMP Media Platform firmware versions V4.2.160, V60.1.4, V60.1.29 is vulnerable to session hijacking due to improper session management on the /UserManagement.html endpoint. Attackers who are on the same network as the victim and have access to the target's logged-in session can...

CVE-2025-63226

The Sencore SMP100 SMP Media Platform (firmware versions V4.2.160 , V60.1.4 , and V60.1.29 ) is vulnerable to session hijacking due to improper session management on the /UserManagement.html endpoint. Attackers located on the same network as a victim can hijack a logged-in session to access this ...

CVE-2025-63226

The Sencore SMP100 SMP Media Platform firmware versions V4.2.160, V60.1.4, V60.1.29 is vulnerable to session hijacking due to improper session management on the /UserManagement.html endpoint. Attackers who are on the same network as the victim and have access to the target's logged-in session can...