Cross site scripting

EyouCms through 2019-07-11 has XSS related to the login.php webrecordnum parameter...

CVE-2019-17430

EyouCms through 2019-07-11 has XSS related to the login.php webrecordnum parameter...

CVE-2019-17430

CVE-2019-17430 affects EyouCms up to 2019-07-11. The issue is an XSS in the login.php web_recordnum parameter. The connected documents confirm the vulnerability type (XSS) and affected component (login flow) but do not provide concrete exploit vectors, affected versions beyond the date, or remedi...

PT-2019-15151

Name of the Vulnerable Software and Affected Versions EyouCms versions prior to 2019-07-11 Description The issue is related to a Cross-Site Scripting XSS problem. It affects the web recordnum parameter in the login.php file. Recommendations For EyouCms versions prior to 2019-07-11, avoid using th...

CVE-2019-17430: Improper Neutralization of Input During Web Page Generation

EyouCms through 2019-07-11 has XSS related to the login.php webrecordnum parameter...

PT-2019-15108

Name of the Vulnerable Software and Affected Versions S-CMS version 1.5 Description The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved by exploiting the member login.php parameter in the tpl.php file. Recommendations For S-CMS version 1.5,...

CVE-2019-16392: Improper Neutralization of Input During Web Page Generation

SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages...

Sql injection

FlameCMS 3.3.5 has SQL injection in account/login.php via accountName...

CVE-2019-16309

FlameCMS 3.3.5 has an SQL injection in account/login.php via the accountName parameter. The root cause is a lack of input validation for SQL statements in a database-backed application, enabling an attacker to execute arbitrary SQL commands. This CVE (CVE-2019-16309) is corroborated by multiple s...

CVE-2019-16309: Improper Neutralization of Special Elements used in an SQL Command

FlameCMS 3.3.5 has SQL injection in account/login.php via accountName...

PT-2019-14618

Name of the Vulnerable Software and Affected Versions FlameCMS version 3.3.5 Description The issue concerns SQL injection in the account/login.php file via the accountName variable. Recommendations For FlameCMS version 3.3.5, update to a version that fixes the SQL injection issue in...

CVE-2019-15826

The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field...

CVE-2019-15826

The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field...

CVE-2019-15826: Undefined Security Weakness

The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field...

PT-2019-14415

Name of the Vulnerable Software and Affected Versions wps-hide-login plugin versions prior to 1.5.3 Description The issue allows for protection bypass via the "wp-login.php" page, specifically through manipulation of the Referer field. Recommendations For versions prior to 1.5.3, update to versio...

PT-2019-11542 · Timesheet · Timesheet Next Gen

Name of the Vulnerable Software and Affected Versions: Timesheet Next Gen versions 1.5.3 and earlier Description: The issue allows an attacker to execute arbitrary HTML and JavaScript code via a redirect parameter. This is a reflected Cross Site Scripting XSS attack, where the victim may click on...

CVE-2019-1010287: Improper Neutralization of Input During Web Page Generation

Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may...

Sql injection

DISPUTED Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass aka the reset password form. NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid...

CVE-2019-12279

Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass aka the reset password form. NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that...

CVE-2019-12279: Improper Neutralization of Special Elements used in an SQL Command

Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass aka the reset password form. NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that...