CVE-2020-26246 Authorization bypass in Pimcore

Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions...

CVE-2020-26246

Pimcore prior to version 6.8.5 is vulnerable to an authorization bypass that allows modifying and creating website settings without proper permissions. The issue stems from insufficient access rights enforcement, enabling an unauthorised user to alter settings, redirects, and asset metadata. Affe...

Pimcore Security Vulnerability

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce frameworks and product information management applications. A security vulnerability exists in Pimcore...

CVE-2020-22273

Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed such as Payment Settings...

CVE-2020-22273

The CVE-2020-22273 entry concerns Neoflex Video Subscription System Version 2.0, where a CSRF flaw enables unauthorized changes to Website Settings (e.g., Payment Settings). The root cause is CSRF allowing state-changing requests without proper user verification. Documents consistently identify t...

CVE-2020-22273

Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed such as Payment Settings...

CVE-2018-17070

An issue was discovered in UNL-CMS 7.59. A CSRF attack can update the website settings via ?q=admin%2Fconfig%2Fsystem%2Fsite-information&render=overlay&render=overlay...

Cross site request forgery (csrf)

An issue was discovered in UNL-CMS 7.59. A CSRF attack can update the website settings via ?q=admin%2Fconfig%2Fsystem%2Fsite-information&render=overlay&render=overlay...

CVE-2018-17070

An issue was discovered in UNL-CMS 7.59. A CSRF attack can update the website settings via ?q=admin%2Fconfig%2Fsystem%2Fsite-information&render=overlay&render=overlay...

CVE-2018-17070

UNL-CMS 7.59 is affected by a CSRF vulnerability (CVE-2018-17070) that allows an attacker to update site settings via the URL path ?q=admin/config/system/site-information&render=overlay&render=overlay. The vulnerability is documented across multiple sources (NVD/CNVD entries) as CSRF that can mod...

portfolioCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-16511)

portfolioCMS is a content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in portfolioCMS version 1.0.5. A remote attacker can exploit this vulnerability to update website settings with the help of the admin/aboutus.php file...

CVE-2018-15849

An issue was discovered in portfolioCMS 1.0.5. There is CSRF to update the website settings via admin/aboutus.php...

Cross site request forgery (csrf)

An issue was discovered in portfolioCMS 1.0.5. There is CSRF to update the website settings via admin/aboutus.php...

CVE-2018-15849

CVE-2018-15849 affects portfolioCMS 1.0.5. The CNVD record describes a cross-site request forgery vulnerability that allows a remote attacker to update website settings via admin/aboutus.php. Only CSRF is specified; no exploit details are provided here. CVSSv3 base score is 4.3 (MEDIUM). No remed...

CVE-2018-14958

An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings such as the theme, title, and description via index.php...

Cross site request forgery (csrf)

An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings such as the theme, title, and description via index.php...

CVE-2018-14958

An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings such as the theme, title, and description via index.php...

CVE-2018-14958

An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings such as the theme, title, and description via index.php...

CVE-2018-11208

An issue was discovered in Z-BlogPHP 2.0.0. There is a persistent XSS that allows remote attackers to inject arbitrary web script or HTML into background web site settings via the "copyright information office" field. NOTE: the vendor indicates that the product was not intended to block this type...

CVE-2015-6780

Use-after-free vulnerability in the Infobars implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site, related to browser/ui/views/websitesettings/websitesettingspopupview.cc...