rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-12944 
Persistent Cross-Site Scripting (XSS) vulnerability in the "Categories" feature in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-31T14:00:00.000Z
CVE-2018-12959 
The approveAndCall function of a smart contract implementation for Aditus (ADI), an Ethereum ERC20 token, allows attackers to steal assets (e.g., transfer all contract balances into their account).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-19T20:00:00.000Z
CVE-2018-12971 
EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T05:00:00.000Z
CVE-2018-12972 
An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T05:00:00.000Z
CVE-2018-12973 
An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T05:00:00.000Z
CVE-2018-12975 
The random() function of the smart contract implementation for CryptoSaga, an Ethereum game, generates a random value with publicly readable variables such as timestamp, the current block's blockhash, and a private variable (which can be read with a getStorageAt call). Therefore, attackers can precompute the random number and manipulate the game (e.g., get powerful characters or get critical damages).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-24T22:00:00.000Z
CVE-2018-12976 
In Go Doc Dot Org (gddo) through 2018-06-27, an attacker could use specially crafted <go-import> tags in packages being fetched by gddo to cause a directory traversal and remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T18:00:00.000Z
CVE-2018-12977 
A SQL injection vulnerability in the SoftExpert (SE) Excellence Suite 2.0 allows remote authenticated users to perform SQL heuristics by pulling information from the database with the "cddocument" parameter in the "Downloading Electronic Documents" section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T18:00:00.000Z
CVE-2018-12979 
An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. Weak permissions allow an authenticated user to overwrite critical files by abusing the unrestricted file upload in the WBM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-12T18:00:00.000Z
CVE-2018-12980 
An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability allows an authenticated user to upload arbitrary files to the file system with the permissions of the web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-12T18:00:00.000Z
CVE-2018-12981 
An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability can be exploited by authenticated and unauthenticated users by sending special crafted requests to the web server allowing injecting code within the WBM. The code will be rendered and/or executed in the browser of the user's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-12T18:00:00.000Z
CVE-2018-12982 
Invalid memory read in the PoDoFo::PdfVariant::DelayedLoad() function in PdfVariant.h in PoDoFo 0.9.6-rc1 allows remote attackers to have denial-of-service impact via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T05:00:00.000Z
CVE-2018-12983 
A stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey() function in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 could be leveraged by remote attackers to cause a denial-of-service via a crafted pdf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T05:00:00.000Z
CVE-2018-12984 
Hycus CMS 1.0.4 allows Authentication Bypass via "'=' 'OR'" credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T05:00:00.000Z
CVE-2018-12988 
GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T05:00:00.000Z
CVE-2018-12989 
The report-viewing feature in Pearson VUE Certiport Console 8 and IQSystem 7 before 2018-06-26 mishandles child processes and consequently launches Internet Explorer or Microsoft Edge as Administrator, which allows local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-03T18:00:00.000Z
CVE-2018-12990 
phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-30T14:00:00.000Z
CVE-2018-12992 
An issue was discovered CMS MaeloStore V.1.5.0. There is stored XSS in the Telephone field of the admin interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T12:00:00.000Z
CVE-2018-12993 
onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force attacks via the onefilecms_username and onefilecms_password fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T12:00:00.000Z
CVE-2018-12994 
onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the New File screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T12:00:00.000Z
CVE-2018-12995 
onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the Upload screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T12:00:00.000Z
CVE-2018-12996 
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T12:00:00.000Z
CVE-2018-12997 
Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows attackers to read certain files on the web server without login by sending a specially crafted request to the server with the operation=copyfile&fileName= substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T12:00:00.000Z
CVE-2018-12998 
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T12:00:00.000Z
CVE-2018-12999 
Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T12:00:00.000Z
CVE-2018-13000 
An XSS issue was discovered in Advanced Electron Forum (AEF) v1.0.9. A persistent XSS vulnerability is located in the `FTP Link` element of the `Private Message` module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to inject malicious script code payloads as a private message (aka pmbody). The injection point is the editor ftp link element and the execution point occurs in the message body context on arrival. The request method to inject is POST with restricted user privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T14:00:00.000Z
CVE-2018-13001 
An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the `admin.php` file of the `./cpshop/` module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack vector of the vulnerability is non-persistent and the request method to inject/execute is GET with the path, search, rename, or dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T14:00:00.000Z
CVE-2018-13002 
An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the `wFilemanager.php` and `index.php` files of the `/grid5/scripts/` modules. The injection point is located in the Project `Title` and the execution point occurs in the `Inhaltsprojekte` output listing section. Remote attackers with privileged user accounts are able to inject their own malicious script code with a persistent attack vector to compromise user session credentials or to manipulate the affected web-application module output context. The request method to inject is POST.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T14:00:00.000Z
CVE-2018-13003 
An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'type' to the /suggest URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T14:00:00.000Z
CVE-2018-13005 
An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read in isomedia/box_code_base.c has a heap-based buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T14:00:00.000Z
CVE-2018-13006 
An issue was discovered in MP4Box in GPAC 0.7.1. There is a heap-based buffer over-read in the isomedia/box_dump.c function hdlr_dump.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T14:00:00.000Z
CVE-2018-13007 
An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for GPMF_KEY_END and nest_level (not conditional on a buffer_size_longs check).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T14:00:00.000Z
CVE-2018-13008 
An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for a positive nest_level.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T14:00:00.000Z
CVE-2018-13009 
An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for GPMF_KEY_END and nest_level (conditional on a buffer_size_longs check).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T14:00:00.000Z
CVE-2018-13010 
WSTMall v1.9.1_170316 has CSRF via the index.php?m=Admin&c=Users&a=edit URI to add a user account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T14:00:00.000Z
CVE-2018-13011 
An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Validate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T15:00:00.000Z
CVE-2018-13012 
Download of code with improper integrity check in snsupd.exe and upd.exe in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, and SoftControl/SafenSoft Enterprise Suite before 4.4.12 allows the remote attacker to execute unauthorized code by substituting a forged update server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T15:00:00.000Z
CVE-2018-13013 
Improper check of unusual conditions when launching msiexec.exe in safensec.com (SysWatch service) in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, and SoftControl/SafenSoft Enterprise Suite before 4.4.9 allows the local attacker to bypass a code-signing protection mechanism and install/execute an unauthorized program by modifying the system configuration and installing a forged MSI file. (The intended behavior is that the component SysWatch does not allow installation of MSI files unless they are signed by a limited list of certificates.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T15:00:00.000Z
CVE-2018-13014 
Storing password in recoverable format in safensec.com (SysWatch service) in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, and SoftControl/SafenSoft Enterprise Suite before 4.4.2 allows the local attacker to restore the SysWatch password from the settings database and modify program settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T15:00:00.000Z
CVE-2018-13021 
An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T17:00:00.000Z
CVE-2018-13022 
Cross-site scripting vulnerability in the API 404 page on Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary JavaScript via a modified URL path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-27T21:00:00.000Z
CVE-2018-13023 
System command injection vulnerability in wifi_access in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute system commands via the "timeout" URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-27T21:00:00.000Z
CVE-2018-13024 
Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T17:00:00.000Z
CVE-2018-13025 
protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=admin/photo/delpic picname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-29T17:00:00.000Z
CVE-2018-13026 
An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-30T12:00:00.000Z
CVE-2018-13030 
An issue was discovered in jpeg-compressor 0.1. The build_huffman function in stb_image.c allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-30T12:00:00.000Z
CVE-2018-13031 
DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T20:00:00.000Z
CVE-2018-13032 
ECESSA ShieldLink SL175EHQ 10.7.4 devices have CSRF to add superuser accounts via the cgi-bin/pl_web.cgi/util_configlogin_act URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-01T16:00:00.000Z
CVE-2018-13033 
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file, as demonstrated by _bfd_elf_parse_attributes in elf-attrs.c and bfd_malloc in libbfd.c. This can occur during execution of nm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-01T16:00:00.000Z
CVE-2018-13034 
Directory traversal in Jester web framework 0.2.0 allows remote attackers to fetch files in arbitrary locations via "..%f" sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T18:00:00.000Z
CVE-2018-13037 
An issue was discovered in jpeg-compressor 0.1. The bmp_load function in stb_image.c allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-01T18:00:00.000Z
CVE-2018-13038 
OpenSID 18.06-pasca has an Unrestricted File Upload vulnerability via an Attachment Document in the article feature. This vulnerability leads to uploading arbitrary PHP code via a .php filename with the application/pdf Content-Type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-01T18:00:00.000Z
CVE-2018-13039 
OpenSID 18.06-pasca has reflected Cross Site Scripting (XSS) via the cari parameter, aka an index.php/first?cari= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-01T18:00:00.000Z
CVE-2018-13040 
OpenSID 18.06-pasca has a CSRF vulnerability. This vulnerability can add an account (at the admin level) via the index.php/man_user/insert URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-01T18:00:00.000Z
CVE-2018-13041 
The mint function of a smart contract implementation for Link Platform (LNK), an Ethereum ERC20 token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-01T18:00:00.000Z
CVE-2018-13042 
The 1Password application 6.8 for Android is affected by a Denial Of Service vulnerability. By starting the activity com.agilebits.onepassword.filling.openyolo.OpenYoloDeleteActivity or com.agilebits.onepassword.filling.openyolo.OpenYoloRetrieveActivity from an external application (since they are exported), it is possible to crash the 1Password instance.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-05T21:00:00.000Z
CVE-2018-13043 
scripts/grep-excuses.pl in Debian devscripts through 2.18.3 allows code execution through unsafe YAML loading because YAML::Syck is used without a configuration that prevents unintended blessing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-01T22:00:00.000Z
CVE-2018-13045 
SQL injection vulnerability in the "Bazar" page in Yeswiki Cercopitheque 2018-06-19-1 and earlier allows attackers to execute arbitrary SQL commands via the "id" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-02T18:00:00.000Z
CVE-2018-13049 
The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, as demonstrated by triggering a crafted LIMIT clause to front/computer.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-02T11:00:00.000Z
CVE-2018-13050 
A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the j_username parameter in a /j_security_check POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-02T11:00:00.000Z
CVE-2018-13052 
In CyberArk Endpoint Privilege Manager (formerly Viewfinity), Privilege Escalation is possible if the attacker has one process that executes as Admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T20:00:00.000Z
CVE-2018-13053 
The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because ktime_add_safe is not used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-02T12:00:00.000Z
CVE-2018-13054 
An issue was discovered in Cinnamon 1.9.2 through 3.8.6. The cinnamon-settings-users.py GUI runs as root and allows configuration of (for example) other users' icon files in _on_face_browse_menuitem_activated and _on_face_menuitem_activated. These icon files are written to the respective user's $HOME/.face location. If an unprivileged user prepares a symlink pointing to an arbitrary location, then this location will be overwritten with the icon content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-02T14:00:00.000Z
CVE-2018-13055 
A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-03T18:00:00.000Z
CVE-2018-13056 
An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcms_main table and then making an img add request. This can be leveraged for database access by deleting install.lock.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-02T15:00:00.000Z
CVE-2018-13060 
Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T14:34:08.000Z
CVE-2018-13063 
Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T14:36:41.000Z
CVE-2018-13065 
ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. NOTE: a third party has disputed this issue because it may only apply to environments without a Core Rule Set configured
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-03T11:00:00.000Z
CVE-2018-13066 
There is a memory leak in util/parser.c in libming 0.4.8, which will lead to a denial of service via parseSWF_DEFINEBUTTON2, parseSWF_DEFINEFONT, parseSWF_DEFINEFONTINFO, parseSWF_DEFINELOSSLESS, parseSWF_DEFINESPRITE, parseSWF_DEFINETEXT, parseSWF_DOACTION, parseSWF_FILLSTYLEARRAY, parseSWF_FRAMELABEL, parseSWF_LINESTYLEARRAY, parseSWF_PLACEOBJECT2, or parseSWF_SHAPEWITHSTYLE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-02T17:00:00.000Z
CVE-2018-13067 
/upload/catalog/controller/account/password.php in OpenCart through 3.0.2.0 has CSRF via the index.php?route=account/password URI to change a user's password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-02T17:00:00.000Z