In Grocy version 4.0.2, there is a Cross-Site Request Forgery (CSRF) vulnerability when creating a new user. The lack of CSRF token or verification methods allows an attacker to craft requests in JSON format to create a new user, exploiting the permission settings of the target user.
In Grocy version 4.0.2, when creating a new user, the request is in JSON format without a CSRF Token or verification method. An attacker can exploit this vulnerability by submitting a crafted HTML form to create a new user if the target is logged in with Create User Permissions.
This exploit allows an attacker to change the admin password and add a user on Linksys Cisco Wag120n and similar versions. The attacker can use the 'sysPasswd' and 'sysConfirmPasswd' fields to set a new password.
This exploit allows an attacker to change the admin account credentials by submitting a form with hidden input fields containing the new username and password values. The form action URL is http://localhost/siteadmin/EditInfo.php.
There are multiple unpatched CSRF vulnerabilities in the administration interfaces for various Linksys routers. Exploits are available that allow remote administration of the router and changing the password to '__pwn3d__'. The victim does not necessarily need to be authenticated since the default passwords for all routers are known to be 'admin'. Most browsers provide some degree of protection against these attacks.
This exploit allows an attacker to change the admin password in Travel PORTAL web application using a CSRF vulnerability. The attacker can craft a malicious HTML page that automatically submits a form to change the password without the knowledge or consent of the admin. The vulnerability exists in the /admin directory of the application.
This version of ASP Shopping Cart has CSRF vulnerability for upload a file with fckEditor. The vulnerability requires the admin's cookie and bypassing a specific file extension implemented by FckEditor v2.
The software version 1.7.3 of pixelpost is vulnerable to stored XSS and CSRF attacks. The 'Image Title' and 'tags' parameters in the admin login page are vulnerable to stored XSS. An attacker can inject malicious code, such as <script>alert('sweet')</script>, to execute arbitrary JavaScript code. Additionally, the admin password change functionality is vulnerable to CSRF. An attacker can change the admin password by sending a crafted request to the 'options' endpoint.
This version of Visinia has multiple vulnerabilities. The first vulnerability is CSRF for Remove Modules, where an attacker can navigate the admin to visit a malicious site to remove a module with a POST request to the server. The second vulnerability is LFI for download web.config or any file.
CSRF exploit for wizmall 6.4 UTF-8 For php that allows changing admin ID and password.
Services By CQR