Apache2Triad Cross-Site Scripting Vulnerability

Apache2Triad is a server software deployment solution for Windows-based platforms. A cross-site scripting vulnerability exists in Apache2Triad version 1.5.4. A remote attacker can exploit this vulnerability by sending the 'account' parameter to the phpsftpd/users.php file to inject arbitrary web...

CVE-2017-12971

Cross-site scripting XSS vulnerability in Apache2Triad 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the account parameter to phpsftpd/users.php...

CVE-2017-12970

Cross-site request forgery CSRF vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack the authentication of authenticated users for requests that 1 add or 2 delete user accounts via a request to phpsftpd/users.php...

CVE-2017-12971

Apache2Triad 1.5.4 has a Persistent Cross-Site Scripting (XSS) vulnerability (CVE-2017-12971) in which an attacker can inject script/HTML via the account parameter to phpsftpd/users.php. The available sources confirm the affected product and vulnerable component (Apache2Triad 1.5.4) and the vulne...

CVE-2017-12971: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Apache2Triad 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the account parameter to phpsftpd/users.php...

CVE-2017-12970: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack the authentication of authenticated users for requests that 1 add or 2 delete user accounts via a request to phpsftpd/users.php...

CVE-2017-11680

Cross-Site Request Forgery CSRF exists in Hashtopussy 0.4.0, allowing an admin password change via users.php...

CVE-2017-11680

Cross-Site Request Forgery CSRF exists in Hashtopussy 0.4.0, allowing an admin password change via users.php...

CVE-2017-11680: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF exists in Hashtopussy 0.4.0, allowing an admin password change via users.php...

CVE-2017-7284: Improper Authentication

An attacker that has hijacked a Unitrends Enterprise Backup before 9.1.2 web server session can leverage api/includes/users.php to change the password of the logged in account without knowing the current password. This allows for an account takeover...

Cross site scripting

Gargaj/wuhu through 2017-03-08 is vulnerable to a reflected XSS in wuhu-master/wwwadmin/users.php id parameter...

CVE-2017-6544

CVE-2017-6544 affects Gargaj/wuhu (wuhu-master) with a reflected XSS in wuhu-master/www_admin/users.php (id parameter). The vulnerability arises from insufficient input validation on the id parameter, enabling arbitrary script execution in victims’ browsers. Documented in NVD/CVE, CNVD-2017-03837...

CVE-2017-6544

Gargaj/wuhu through 2017-03-08 is vulnerable to a reflected XSS in wuhu-master/wwwadmin/users.php id parameter...

CVE-2017-6544: Improper Neutralization of Input During Web Page Generation

Gargaj/wuhu through 2017-03-08 is vulnerable to a reflected XSS in wuhu-master/wwwadmin/users.php id parameter...

CVE-2017-6446: Improper Neutralization of Input During Web Page Generation

XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters...

PT-2015-6844

Name of the Vulnerable Software and Affected Versions wp-championship plugin version 5.8 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved through SQL injection vulnerabilities in the cs admin users.php file, specifically via the user, isadmin, mail...

PT-2015-7308

Name of the Vulnerable Software and Affected Versions Pligg CMS version 2.0.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that add an administrator via a request to "admin/admin users.php". Recommendations...

CVE-2014-9570: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the MyWebsiteAdvisor Simple Security plugin 1.1.5 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 datefilter parameter in the accesslog page to wp-admin/users.php or 2 simplesecurityipblacklist...

WordPress plugin Simple Security '/wp-admin/users.php' has multiple cross-site scripting vulnerabilities

WordPress is a blogging platform developed using the PHP language that allows users to set up their weblogs on servers that support PHP and MySQL databases. The WordPress plugin Simple Security '/wp-admin/users.php' suffers from multiple cross-site scripting vulnerabilities because it fails to...

CVE-2014-100018: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Unconfirmed plugin before 1.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in the unconfirmed page to wp-admin/network/users.php...