CVE-2020-18129

A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php...

Default credentials

tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts...

CVE-2020-15906

CVE-2020-15906 affects Tiki Wiki CMS GroupWare before 21.2. The flaw in tiki-login.php allows an authentication bypass: after 50 invalid login attempts, the admin password is set to blank, permitting unauthenticated admin access. Remediation: upgrade to version 21.2 or later. CVSS 3.1 base score ...

CVE-2020-15906

tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts...

CVE-2020-15906: Improper Restriction of Excessive Authentication Attempts

tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts...

CVE-2020-18129: Cross-Site Request Forgery (CSRF)

A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php...

PT-2020-15085

Name of the Vulnerable Software and Affected Versions Eyoucms version 1.2.7 Description A CSRF issue allows an attacker to add an admin account via the "login.php" endpoint. This can be exploited to gain unauthorized access to the system. Recommendations For Eyoucms version 1.2.7, consider...

Design/Logic Flaw

phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter...

CVE-2020-27163

phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter...

CVE-2020-27163

phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter...

CVE-2020-27163: Improper Neutralization of Input During Web Page Generation

phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter...

PT-2020-16644

Name of the Vulnerable Software and Affected Versions phpRedisAdmin versions prior to 1.13.2 Description The issue allows for XSS via the username parameter in the "login.php" endpoint. This affects a significant number of devices, but the exact count is not specified. There is no information...

CVE-2020-25006

Heybbs v1.2 has a SQL injection vulnerability in login.php file via the username parameter which may allow a remote attacker to execute arbitrary code...

Sql injection

Heybbs v1.2 has a SQL injection vulnerability in login.php file via the username parameter which may allow a remote attacker to execute arbitrary code...

CVE-2020-25006

Heybbs v1.2 has a SQL injection vulnerability in login.php file via the username parameter which may allow a remote attacker to execute arbitrary code...

CVE-2020-25006

The CVE-2020-25006 entry concerns Heybbs v1.2, with a SQL injection vulnerability in login.php via the username parameter that may allow a remote attacker to execute arbitrary code. The affected component is the login logic in Heybbs 1.2; underlying cause is a SQL injection flaw in user authentic...

PT-2020-15885

Name of the Vulnerable Software and Affected Versions Heybbs version 1.2 Description The issue is related to a SQL injection vulnerability in the login.php file, specifically via the username parameter. This may allow a remote attacker to execute arbitrary code. Recommendations For Heybbs version...

CVE-2020-25006: Improper Neutralization of Special Elements used in an SQL Command

Heybbs v1.2 has a SQL injection vulnerability in login.php file via the username parameter which may allow a remote attacker to execute arbitrary code...

elaniin CMS - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: elaniin CMS 1.0 - Authentication Bypass Exploit Author: BKpatron Vendor Homepage:https://elaniin.com/ Software Link:https://github.com/elaniin/CMS/archive/master.zip Version: v1.0 Tested on: Win 10 CVE: N/A Vulnerability: Attack...

PT-2020-14694

Name of the Vulnerable Software and Affected Versions D-Link DAP-1522 devices versions 1.4x through 1.10b04Beta01 Description An authentication-bypass issue allows unauthorized users to access certain pages directly. This is due to the checking of the NO NEED AUTH value. If NO NEED AUTH is set to...