CVE-2026-64829: Insufficient Session Expiration

Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php...

PT-2022-20335

Name of the Vulnerable Software and Affected Versions Wedding Management version 1.0 Description The issue is related to an arbitrary file upload vulnerability. This vulnerability is located in the picture upload point of the "users edit.php" file. Recommendations For Wedding Management version...

CVE-2020-23342

A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users...

CVE-2020-23342

A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users...

PT-2021-10883

Name of the Vulnerable Software and Affected Versions Anchor CMS version 0.12.7 Description A CSRF issue exists in the anchor/views/users/edit.php file of Anchor CMS, allowing the deletion of admin users. Recommendations For Anchor CMS version 0.12.7, consider disabling the edit user functionalit...

CVE-2020-23342: Cross-Site Request Forgery (CSRF)

A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users...

PT-2020-13753

Name of the Vulnerable Software and Affected Versions Kordil EDMS versions through 2.2.60rc3 Description The issue allows stored XSS in several PHP files, including users edit.php, users management edit.php, and user management.php. Recommendations For versions through 2.2.60rc3, consider disabli...

CVE-2019-1010096

DomainMOD v4.10.0 is affected by: Cross Site Request Forgery CSRF. The impact is: There is a CSRF vulnerability that can change the read-only user to admin. The component is: admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page...

CVE-2019-1010096

DomainMOD v4.10.0 is affected by: Cross Site Request Forgery CSRF. The impact is: There is a CSRF vulnerability that can change the read-only user to admin. The component is: admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page...

CVE-2019-1010096

DomainMOD v4.10.0 contains a Cross Site Request Forgery (CSRF) vulnerability that can elevate a user’s privilege from read-only to administrator. The vulnerability is triggered via the admin/users/edit.php?uid=2 component after an administrator logs in and visits a crafted HTML page, enabling an ...

CVE-2019-1010094

domainmod v4.10.0 is affected by: Cross Site Request Forgery CSRF. The impact is: There is a CSRF vulnerability that can change admin password. The component is: http://127.0.0.1/settings/password/ http://127.0.0.1/admin/users/add.php http://127.0.0.1/admin/users/edit.php?uid=2. The attack vector...

CVE-2019-1010096: Cross-Site Request Forgery (CSRF)

DomainMOD v4.10.0 is affected by: Cross Site Request Forgery CSRF. The impact is: There is a CSRF vulnerability that can change the read-only user to admin. The component is: admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page...

PT-2019-11463

Name of the Vulnerable Software and Affected Versions: domainmod version 4.10.0 Description: The issue allows for Cross Site Request Forgery CSRF attacks, which can lead to a change in the admin password. The affected components include the "http://127.0.0.1/settings/password/" endpoint, as well ...

PT-2019-11465

Name of the Vulnerable Software and Affected Versions: DomainMOD version 4.10.0 Description: The issue allows for a Cross Site Request Forgery CSRF attack, which can change a read-only user to an admin. The component affected is the "admin/users/edit.php?uid=2" endpoint. The attack can occur afte...

CVE-2019-1010094: Cross-Site Request Forgery (CSRF)

domainmod v4.10.0 is affected by: Cross Site Request Forgery CSRF. The impact is: There is a CSRF vulnerability that can change admin password. The component is: http://127.0.0.1/settings/password/ http://127.0.0.1/admin/users/add.php http://127.0.0.1/admin/users/edit.php?uid=2. The attack vector...

PT-2015-6420

Name of the Vulnerable Software and Affected Versions ISPConfig versions prior to 3.0.5.4p7 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for requests that create...

PT-2015-5780

Name of the Vulnerable Software and Affected Versions ProjectSend formerly cFTP version r561 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the id parameter to the "users-edit.php" endpoint. Recommendations For version r561, update ...

CVE-2015-2564: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in client-edit.php in ProjectSend formerly cFTP r561 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to users-edit.php...

PT-2011-2521

Name of the Vulnerable Software and Affected Versions phpLD version 4.1.0 Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack the authentication of administrators for requests that add an administrator via the N action. This occurs in the admin/conf use...