PT-2014-8809

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.7.5 WordPress versions 3.8.x prior to 3.8.5 WordPress versions 3.9.x prior to 3.9.3 WordPress versions 4.x prior to 4.0.1 Description The issue allows remote attackers to reset passwords by leveraging access to an...

CVE-2014-9039: Undefined Security Weakness

wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message...

PT-2014-8803

Name of the Vulnerable Software and Affected Versions WordPress versions 3.7.4, 3.8.4, 3.9.2, and 4.0 Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack the authentication of arbitrary users for requests that reset passwords. This occurs in the...

WordPress <= 4.0.0 - CSRF

Because of this vulnerability in wp-login.php, the attackers can hijack the authentication of arbitrary users for requests that reset passwords. Solution Update WordPress...

WordPress <= 4.0.0 - Multiple Vulnerabilities #1

There are multiple vulnerabilities in WordPress wp-login.php, such as cross site scripting, denial of service attacks, hash comparison, SSRF, CSRF. Because of these vulnerabilities, attackers can reset passwords by leveraging access to an e-mail account that received a password-reset message...

Sql injection

SQL injection vulnerability in login.php in MegaLab The Uploader before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2011-2944

CVE-2011-2944 affects MegaLab The Uploader prior to version 2.0.5. The login.php handling allows a SQL injection via the username parameter, enabling remote attackers to execute arbitrary SQL commands. The NVD record lists a CVSS v2 base score of 7.5 (HIGH) with network access, low attack complex...

CVE-2011-2944: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in MegaLab The Uploader before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter...

PT-2014-2134

Name of the Vulnerable Software and Affected Versions MegaLab The Uploader versions prior to 2.0.5 Description The issue allows remote attackers to execute arbitrary SQL commands via the username parameter in the login.php file. Recommendations For versions prior to 2.0.5, update to version 2.0.5...

Cross site scripting

Cross-site scripting XSS vulnerability in Status2k allows remote attackers to inject arbitrary web script or HTML via the username to login.php...

CVE-2014-5088

CVE-2014-5088 is a cross-site scripting (XSS) vulnerability in Status2k Server Monitoring Software. The risk entry describes an attacker injecting arbitrary script/HTML through the username parameter sent to login.php, enabling remote exploitation. Public records in the NVD entry enumerate the fl...

CVE-2014-5088: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Status2k allows remote attackers to inject arbitrary web script or HTML via the username to login.php...

PT-2014-6271

Name of the Vulnerable Software and Affected Versions Status2k affected versions not specified Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the username to "login.php". Recommendations At the...

WP Affiliate Manager - login.php msg Parameter XSS

The wp-affiliate-platform WordPress plugin was affected by a login.php msg Parameter XSS security vulnerability...

Pie Register - wp-login.php Multiple Parameter XSS

The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin was affected by a wp-login.php Multiple Parameter XSS security vulnerability...

WordPress Members Plugin <= 2.8.9 - Reflected XSS

This plugin is prone to a cross site scripting vulnerability in wp-login.php. Solution Update the plugin...

PT-2014-6278

Name of the Vulnerable Software and Affected Versions WeBid version 1.1.1 Description The issue allows remote attackers to inject arbitrary web script or HTML via multiple parameters in actions to register.php and user login.php. The affected parameters include TPL name, TPL nick, TPL email, TPL...

PT-2014-5984

Name of the Vulnerable Software and Affected Versions VideoWhisper Video Presentation plugin versions prior to 3.31 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically,...

AfterLogic MailBee WebMail Pro 3.x login.php mode Parameter XSS

No description provided by source...

myBloggie 2.1.5 login.php PATH_INFO Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/22097/info MyBloggie is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code...