CVE-2023-43147

PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery CSRF to add an admin user via the Add Users Function, aka an index.php?controller=pjAdminUsers&action=pjActionCreate URI...

CVE-2023-43147

PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery CSRF to add an admin user via the Add Users Function, aka an index.php?controller=pjAdminUsers&action=pjActionCreate URI...

CVE-2023-43147

PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery CSRF to add an admin user via the Add Users Function, aka an index.php?controller=pjAdminUsers&action=pjActionCreate URI...

Cross site request forgery (csrf)

PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery CSRF to add an admin user via the Add Users Function, aka an index.php?controller=pjAdminUsers&action=pjActionCreate URI...

PT-2023-28717 · Phpjabbers · Phpjabbers Limo Booking

Name of the Vulnerable Software and Affected Versions: PHPJabbers Limo Booking Software version 1.0 Description: The issue allows for Cross Site Request Forgery CSRF to add an admin user via the Add Users Function. This can be achieved through the...

CVE-2023-43147

PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery CSRF to add an admin user via the Add Users Function, aka an index.php?controller=pjAdminUsers&action=pjActionCreate URI...

CVE-2023-43147: Cross-Site Request Forgery (CSRF)

PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery CSRF to add an admin user via the Add Users Function, aka an index.php?controller=pjAdminUsers&action=pjActionCreate URI...

CVE-2023-43147

PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery CSRF to add an admin user via the Add Users Function, aka an index.php?controller=pjAdminUsers&action=pjActionCreate URI...

CVE-2023-34626

Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function...

CVE-2023-34626

Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function...

Sql injection

Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function...

WS-2023-0191

SQL Injection in the "Users" function of Piwigo in GitHub repository piwigo/piwigo prior to 13.8.0. An authenticated admin can dump all the database information...

CVE-2023-34626: Improper Neutralization of Special Elements used in an SQL Command

Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function...

CVE-2023-34626

Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function...

CVE-2023-34626

Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function...

CVE-2023-34626

CVE-2023-34626 affects Piwigo 13.7.0 and is a SQL injection vulnerability in the "+Users" function. The connected documents corroborate the impact as SQL injection on Piwigo 13.7.0, but do not provide concrete details on the root cause, specific vulnerable query, affected versions beyond 13.7.0, ...

PT-2023-24958 · Piwigo · Piwigo

Name of the Vulnerable Software and Affected Versions: Piwigo version 13.7.0 Description: The issue concerns SQL Injection via the Users function. Recommendations: For Piwigo version 13.7.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability...

CVE-2023-2599

The Active Directory Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to missing nonce verification on the getusers function and insufficient escaping o...

WordPress Plugin Active Directory Integration Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

SQL Injection in the "Users" function of Piwigo

Description Authenticated admin can perform an SQL injection attack by abusing the "Users" function. Proof of Concept - Log in as an admin and access the 'Users' function. - Observe the request on Burp suite POST /piwigo/ws.php?format=json&method=pwg.users.getList. - Manipulate the 'order' or...