CVE-2019-19144: Improper Restriction of Recursive Entity References in DTDs

XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 11449-53631 Build304 devices via rest/Users?action=authenticate...

PT-2022-13119 · WordPress · Customize Wordpress Emails/Alerts

Name of the Vulnerable Software and Affected Versions: The Customize WordPress Emails and Alerts WordPress plugin versions prior to 1.8.7 Description: The issue concerns a lack of authorization and CSRF check in the bnfw search users AJAX action. This allows any authenticated users to call the...

PT-2022-10038

Name of the Vulnerable Software and Affected Versions BeyondTrust Secure Remote Access Base Software versions prior to 6.0.2 Description A cross-site scripting XSS issue allows the injection of specially-crafted web requests without proper sanitization. This occurs when an unauthenticated, crafte...

PT-2019-19860

Name of the Vulnerable Software and Affected Versions PilusCart version 1.4.1 Description The issue allows for a CSRF attack via the "index.php?module=users&action=newUser" endpoint, potentially leading to the addition of a new user with administrator privileges. Recommendations For PilusCart...

PT-2018-10593

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns a session management problem in the Administrations Tab of Monstra CMS. Specifically, changing a password at the "admin/index.php?id=users&action=edit&user id=1" endpoint does not...

PT-2018-10320

Name of the Vulnerable Software and Affected Versions doorGets version 7.0 Description The issue concerns a CSRF problem in the dg-user/?controller=users&action=add API endpoint, which can lead to the addition of an administrator account. Recommendations For doorGets version 7.0, consider...

CVE-2018-11126: Cross-Site Request Forgery (CSRF)

dg-user/?controller=users&action=add in doorGets 7.0 has CSRF that results in adding an administrator account...

CVE-2010-5320

Multiple cross-site request forgery CSRF vulnerabilities in MemHT Portal 4.0.1 allow remote attackers to hijack the authentication of administrators for requests that 1 modify settings via a configuration action to admin.php, 2 modify articles via an articles action to admin.php, or 3 modify...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in MemHT Portal 4.0.1 allow remote attackers to hijack the authentication of administrators for requests that 1 modify settings via a configuration action to admin.php, 2 modify articles via an articles action to admin.php, or 3 modify...

CVE-2013-4624

Multiple cross-site scripting XSS vulnerabilities in Jahia xCM 6.6.1.0 before hotfix 7 allow remote attackers to inject arbitrary web script or HTML via 1 the site parameter to engines/manager.jsp, 2 the searchString parameter to administration/ in a search action, or the 3 username, 4 firstName,...

CVE-2012-3837: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in apps/users/registration.template.php in Baby Gekko 1.2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 username, 2 emailaddress, 3 password, 4 passwordverify, 5 firstname, 6 lastname, or 7 verificationcode...

PT-2012-5033

Name of the Vulnerable Software and Affected Versions Baby Gekko versions 1.2.0 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including username, email address, password, password verify, firstname, lastname, or verificati...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the J-Web interface in Juniper JUNOS 8.5R1.14 allow remote authenticated users to inject arbitrary web script or HTML via the host parameter to 1 the pinghost program, reachable through the diagnose program; or 2 the traceroute program, reachab...

CVE-2009-3486

Multiple cross-site scripting XSS vulnerabilities in the J-Web interface in Juniper JUNOS 8.5R1.14 allow remote authenticated users to inject arbitrary web script or HTML via the host parameter to 1 the pinghost program, reachable through the diagnose program; or 2 the traceroute program, reachab...