Milos Zivanovic

**Name of the Vulnerable Software and Affected Versions** Acc Statistics version 1.1 **Description** The issue allows remote attackers to hijack the authentication of administrators for requests that change passwords, usernames, and e-mail addresses due to multiple cross-site request forgery (CSRF) vulnerabilities in index.php. **Recommendations** For Acc Statistics version 1.1, as a temporary workaround, consider restricting access to the index.php file until a patch is available. Avoid using the affected index.php file for administrative tasks that involve changing sensitive information, such as passwords, usernames, and e-mail addresses, until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ScriptsEz Mini Hosting Panel (affected versions not specified) **Description** A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack administrator authentication for requests that alter administrative settings. This is achieved via a `cp` action in the `admin ac.php` file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mail Manager Pro (affected versions not specified) **Description** A cross-site request forgery (CSRF) issue exists in the admin.php file, allowing remote attackers to hijack administrator authentication for requests that modify the admin password through a change action. This can be achieved by exploiting the `change` action. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ez Poll Hoster (EPH) (affected versions not specified) **Description** The issue allows remote attackers to hijack the authentication of arbitrary users for requests that delete polls via the "delete poll" action to "index.php". Additionally, attackers can hijack the authentication of administrators for requests that delete users via the "manage" action to "admin.php", or send arbitrary email to arbitrary users in the "email" action to "admin.php". **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.