Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (8351 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-17070 1 Unlcms 1 Unlcms 2024-11-21 N/A
An issue was discovered in UNL-CMS 7.59. A CSRF attack can update the website settings via ?q=admin%2Fconfig%2Fsystem%2Fsite-information&render=overlay&render=overlay.
CVE-2018-17069 1 Unlcms 1 Unlcms 2024-11-21 N/A
An issue was discovered in UNL-CMS 7.59. A CSRF attack can create new content via ?q=node%2Fadd%2Farticle&render=overlay&render=overlay.
CVE-2018-17045 1 Cms Maelostore Project 1 Cms Maelostore 2024-11-21 N/A
An issue was discovered in CMS MaeloStore V.1.5.0. There is a CSRF vulnerability that can change the administrator password via admin/modul/users/aksi_users.php?act=update.
CVE-2018-17023 1 Asus 2 Gt-ac5300, Gt-ac5300 Firmware 2024-11-21 N/A
Cross-site request forgery (CSRF) vulnerability on ASUS GT-AC5300 routers with firmware through 3.0.0.4.384_32738 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to start_apply.htm.
CVE-2018-16966 1 Filemanagerpro 1 File Manager 2024-11-21 N/A
There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.
CVE-2018-16952 1 Oracle 1 Webcenter Interaction 2024-11-21 N/A
The Oracle WebCenter Interaction Portal 10.3.3 does not implement protection against Cross-site Request Forgery in its design. The impact is sensitive actions in the portal (such as changing a portal user's password). NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
CVE-2018-16951 1 Xunfeng Project 1 Xunfeng 2024-11-21 N/A
xunfeng 0.2.0 allows command execution via CSRF because masscan.py mishandles backquote characters, a related issue to CVE-2018-16832.
CVE-2018-16854 1 Moodle 1 Moodle 2024-11-21 N/A
A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.
CVE-2018-16832 1 Xunfeng Project 1 Xunfeng 2024-11-21 N/A
CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file because views/lib/AntiCSRF.py can overwrite the request.host value with the content of the X-Forwarded-Host HTTP header.
CVE-2018-16795 1 Open-emr 1 Openemr 2024-11-21 8.8 High
OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, as demonstrated by use of interface/super/manage_site_files.php to upload a .php file.
CVE-2018-16732 1 Chshcms 1 Cscms 2024-11-21 N/A
\upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftp_save.
CVE-2018-16650 1 Phpmyfaq 1 Phpmyfaq 2024-11-21 N/A
phpMyFAQ before 2.9.11 allows CSRF.
CVE-2018-16634 1 Pluck-cms 1 Pluck 2024-11-21 N/A
Pluck v4.7.7 allows CSRF via admin.php?action=settings.
CVE-2018-16552 1 Micropyramid 1 Django Crm 2024-11-21 8.8 High
MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users/##/edit/, and /accounts/##/delete/ URIs.
CVE-2018-16458 1 Baigo 1 Baigo Cms 2024-11-21 N/A
An issue was discovered in baigo CMS v2.1.1. There is an index.php?m=article&c=request CSRF that can cause publication of any article.
CVE-2018-16449 1 Onethink 1 Onethink 2024-11-21 N/A
OneThink 1.1.141212 allows CSRF for adding a page via admin.php?s=/Channel/add.html, adding a blog via admin.php?s=/Article/update.html, and setting the audit state via admin.php?s=/Article/setStatus/status/1.html.
CVE-2018-16448 1 Chshcms 1 Cscms 2024-11-21 N/A
Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save.
CVE-2018-16447 1 Frogcms Project 1 Frogcms 2024-11-21 N/A
Frog CMS 0.9.5 has admin/?/user/edit/1 CSRF.
CVE-2018-16431 1 Yfcmf 1 Yfcmf 2024-11-21 N/A
admin/admin/adminsave.html in YFCMF v3.0 allows CSRF to add an administrator account.
CVE-2018-16416 1 Thedaylightstudio 1 Fuel Cms 2024-11-21 N/A
Cross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password.