CVE-2014-9459: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the AdminObserver function in e107admin/users.php in e107 2.0 alpha2 allows remote attackers to hijack the authentication of administrators for requests that add users to the administrator group via the id parameter in an admin action...

CVE-2011-5300

CVE-2011-5300 affects poMMo Aardvark PR16.1. a CSRF in admin/setup/config/users.php allows remote attackers to hijack administrator authentication by submitting requests that modify credentials via certain admin_ parameters. Root cause is a CSRF in the credential-modification flow. Impact describ...

CVE-2011-5300: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin/setup/config/users.php in poMMo Aardvark PR16.1 allows remote attackers to hijack the authentication of administrators for requests that modify credentials via certain admin parameters...

oxwall 1.7.0 /users.php 跨站脚本漏洞

No description provided by source...

Geeklog 1.3.7 users.php uid Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/6602/info Geeklog is prone to a cross-site scripting vulnerability in the 'users.php' script. This issue is due to insufficient sanitization of input submitted in URI parameters. As a result, an attacker may create a...

Phorum 5.1.20 include/controlcenter/users.php Multiple Method Remote Privilege Escalation

No description provided by source. source: http://www.securityfocus.com/bid/23616/info Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the...

WEBInsta CMS <= 0.3.1 (users.php) Remote File Include Vulnerability

No description provided by source. / Vulnerable product : http://www.webinsta.com/download.html WEBInsta. CMS 0.3.1 Author : Yns - yns.zaxaz.com / Exploit: http://HOST/PATH/modules/usersonline/users.php?moduledir=REMOTEFILE milw0rm.com 2006-08-15...

Eggblog 3.1 admin/users.php add Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/21134/info Eggblog is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the...

CVE-2012-6562: Undefined Security Weakness

engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts...

CVE-2012-6511: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in organizer/page/users.php in the Organizer plugin 1.2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 deleteid parameter or 2 extension parameter in an "Update Setting" action to wp-admin/admin.php...

CVE-2012-3872: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open Constructor 3.12.0 allow remote attackers to inject arbitrary web script or HTML via 1 the result parameter to data/file/edit.php, 2 the q parameter to confirm.php, or 3 the keyword parameter to users/users.php...

Cross site scripting

Cross-site scripting XSS vulnerability in users.php in File King Advanced File Management 1.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2012-6040: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in users.php in File King Advanced File Management 1.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2012-5908: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/modules/user/users.php in MyBB aka MyBulletinBoard 1.6.6 allows remote attackers to inject arbitrary web script or HTML via the conditionsusergroup parameter in a search action to admin/index.php...

CVE-2012-5909: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/modules/user/users.php in MyBB aka MyBulletinBoard 1.6.6 allows remote attackers to execute arbitrary SQL commands via the conditionsusergroup parameter in a search action to admin/index.php...

Exploit Title: Mihalism Multi Host v 5.0

Exploit Title: Mihalism Multi Host v 5.0 Google Dork: intext:"powered by Mihalism Multi Host" Date: 2012/8/25 Discovered By : Explo!ter Software Link: http://www.mihalismscript.com/ Version: 5.0 Tested on: Linux Contact : Emperor-team.org Spt to : Stokke Details : ++++++++++++++++++++++++++ the...

Mihalism Multi Host 5.0 Cross Site Scripting

Exploit Title: Mihalism Multi Host v 5.0 Google Dork: intext:"powered by Mihalism Multi Host" Date: 2012/8/25 Discovered By : Explo!ter Software Link: http://www.mihalismscript.com/ Version: 5.0 Tested on: Linux Contact : Emperor-team.org Spt to : Stokke Details : ++++++++++++++++++++++++++ the...

Mihalism Multi Host - users.php Cross-Site Scripting

Mihalism Multi Host - users.php Cross-Site Scripting source: https://www.securityfocus.com/bid/55237/info Mihalism Multi Host is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script...

CVE-2012-4325: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in upload/users.php in Utopia News Pro UNP 1.4.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts...

CVE-2012-2236

PHP Gift Registry 1.5.5 is vulnerable to a SQL injection in users.php (userid parameter in the edit action). The issue allows remote authenticated users to execute arbitrary SQL commands. This is caused by unsafely concatenated input in the edit workflow, enabling database command execution. The ...