2581 matches found
Cross site scripting
Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element...
CVE-2020-6850
Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element...
CVE-2020-6850
Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element...
CVE-2020-6850: Improper Neutralization of Input During Web Page Generation
Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element...
PT-2020-19264
Name of the Vulnerable Software and Affected Versions miniorange-saml-20-single-sign-on plugin versions prior to 4.8.84 Description The issue allows for XSS via a crafted SAML XML Response to "wp-login.php". This is related to the SAMLResponse and RelayState variables, and the Destination paramet...
Design/Logic Flaw
bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter...
CVE-2019-20173
The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...
Design/Logic Flaw
The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...
CVE-2019-20173
The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...
CVE-2011-1150: Improper Neutralization of Input During Web Page Generation
bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter...
PT-2020-7094
Name of the Vulnerable Software and Affected Versions bbPress versions 1.0.0 through 1.0.2 Description The issue concerns a cross-site scripting XSS flaw in the /bb-login.php URL, specifically via the re parameter. This allows for potential malicious script injection. No information is provided...
CVE-2019-20173: Improper Neutralization of Input During Web Page Generation
The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...
PT-2020-10357
Name of the Vulnerable Software and Affected Versions Auth0 wp-auth0 plugin versions 3.11.x through 3.11.2 Description The issue allows for XSS via a wle parameter associated with the "wp-login.php" endpoint. This affects the Auth0 wp-auth0 plugin for WordPress. Recommendations For Auth0 wp-auth0...
Auth0 < 3.11.3 - Unauthenticated Reflected XSS via wle Parameter
XSS via a wle parameter associated with wp-login.php. PoC WP/wp-login.php?wle=%22%20onEvent%3DX186697040Y2Z%20...
PT-2020-19936
Name of the Vulnerable Software and Affected Versions UseBB version 1.0.12 Description The issue allows for a login bypass due to type juggling in the panel login.php file. This occurs because the != operator is used instead of !== for password hashes, leading to mishandling of hashes that begin...
elaniin CMS 1.0 - Authentication Bypass
Exploit Title: elaniin CMS 1.0 - Authentication Bypass Author: riamloo Date: 2020-01-02 Vendor Homepage: https://elaniin.com/ github == https://github.com/elaniin/ Software Link: https://github.com/elaniin/CMS/archive/master.zip Version: 1 CVE: N/A Tested on: Win 10 Discription: Open-source Conte...
BloodX 1.0 SQL Injection
Exploit Title: BloodX 1.0 - Authentication Bypass Author: riamloo Date: 2019-12-31 Vendor Homepage: https://github.com/diveshlunker/BloodX Software Link: https://github.com/diveshlunker/BloodX/archive/master.zip Version: 1 CVE: N/A Tested on: Win 10 Discription: An standalone platform which lets...
PT-2019-7084
Name of the Vulnerable Software and Affected Versions POSH versions 3.0 through 3.2.1 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the error parameter to "/includes/plugins/mobile/scripts/login.php" or the id parameter to...
CVE-2014-2214: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in POSH aka Posh portal or Portaneo 3.0 through 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 error parameter to /includes/plugins/mobile/scripts/login.php or 2 id parameter to portal/openrssarticle.php...
