PT-2021-22295

Name of the Vulnerable Software and Affected Versions Simple Water Refilling Station Management System version 1.0 Description SQL Injection can occur via the username parameter in the water refilling/classes/Login.php file. This issue allows for potential SQL injection attacks. Recommendations F...

CVE-2021-38840: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection can occur in Simple Water Refilling Station Management System 1.0 via the waterrefilling/classes/Login.php username parameter...

eLearning V2(by: oretnom23) is vulnerable from remote SQL-Injection-Bypass-Authentication

Description: The eLearning V2by: oretnom23 is vulnerable from remote SQL-Injection-Bypass-Authentication in 3 accounts of the system admin, Faculty & Student in app /elearning/classes/Login.php. remote SQL-Injection-Bypass-Authentication: . The parameter username, facultyid, and studentid from th...

Online Leave Management System 1.0 SQL Injection

Exploit Title: OLMS - PHP by: oretnom23 v1.0 SQL-Injection-Bypass-Authentication in /leavesystem/classes/Login.php. Author: nu11secur1ty Testing and Debugging: nu11secur1ty Date: 08.31.2021 Vendor: https://www.sourcecodester.com/php/14910/online-leave-management-system-php-free-source-code.html...

SES-by-oretnom23 -v1.0-SQL-Injection-bypass-Login

The SES-byoretnom23 -v1.0 is vulnerable in the application /elearning/classes/Login.php which is called from /elearning/dist/js/script.js app. The parameter username from the login form is not protected correctly and there is no security and escaping from malicious payloads. When the user is...

EyouCMS Cross-site Request Forgery Vulnerability

EyouCMS is an open source content management system CMS based on ThinkPHP.EyouCMS suffers from a cross-site request forgery vulnerability, which stems from a cross-site request forgery CSRF vulnerability in EyouCMS 1.3.6. An attacker could use the vulnerability to execute js code by adding an htm...

CVE-2020-20642

Cross Site Request Forgery CSRF vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn...

CVE-2020-20642

Cross Site Request Forgery CSRF vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn...

PT-2021-10519

Name of the Vulnerable Software and Affected Versions: EyouCMS version 1.3.6 Description: A Cross Site Request Forgery CSRF issue exists, allowing an attacker to add an htm page that can execute js code via the login.php endpoint with specific parameters: m=admin, c=Filemanager, a=newfile, and...

CVE-2020-20642: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn...

CVE-2020-19669

Cross Site Request Forgery CSRF vulnerability exists in Eyoucms 1.3.6 that can add an admin account via /login.php?m=admin&c=Admin&a=adminadd&lang=cn...

PT-2021-10386

Name of the Vulnerable Software and Affected Versions: Eyoucms version 1.3.6 Description: A Cross Site Request Forgery CSRF issue exists, allowing an attacker to add an admin account via the /login.php?m=admin&c=Admin&a=admin add&lang=cn API endpoint. This can be exploited by manipulating the m, ...

CVE-2020-23148

The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request...

CVE-2020-23148: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request...

Cross site scripting

Cross Site Scripting XSS vulnerability in gnuboard5 =v5.3.2.8 via the url parameter to bbs/login.php...

CVE-2020-18661

Cross Site Scripting XSS vulnerability in gnuboard5 =v5.3.2.8 via the url parameter to bbs/login.php...

CVE-2020-18661: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in gnuboard5 =v5.3.2.8 via the url parameter to bbs/login.php...

MetInfo Cross-Site Scripting Vulnerability (CNVD-2021-49143)

MetInfo is a Content Management System CMS developed using PHP and Mysql. A cross-site scripting vulnerability exists in MetInfo. The vulnerability can be exploited to conduct cross-site scripting attacks via the gourl parameter in login.php...

CVE-2020-22165

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...

CVE-2020-22165: Improper Neutralization of Special Elements used in an SQL Command

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...