Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the in_id parameter, which allows remote attackers to modify information of arbitrary users, as demonstrated by modifying (1) passwords and (2) permissions, (3) viewing profile settings, and (4) creating and (5) deleting users.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Neon WebMail For Java 多个输入验证漏洞
Vulnerability Description
Neon WebMail for Java before 5.08中的updateuser servlet不验证in_id参数，远程攻击者可以修改任意用户的信息，如通过修改(1)密码和(2)许可权、(3)查看配置文件设置，以及(4)创建和(5)删除用户所示。
CVSS Information
N/A
Vulnerability Type
N/A