204 matches found
Authentication flaw
The checkpassword function in html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to bypass authentication via an empty password...
CVE-2011-4069
html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and consequently bypass authentication via a crafted username...
CVE-2011-4068
The checkpassword function in html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to bypass authentication via an empty password...
PT-2018-4034
Name of the Vulnerable Software and Affected Versions PacketFence versions prior to 3.0.2 Description The issue allows remote attackers to bypass authentication. This is possible due to the check password function in html/admin/login.php allowing an empty password. Recommendations For versions...
PT-2018-4035
Name of the Vulnerable Software and Affected Versions PacketFence versions prior to 3.0.2 Description The issue allows remote attackers to conduct LDAP injection attacks, which can lead to authentication bypass via a crafted username. This is related to the html/admin/login.php file...
CVE-2011-4068: Improper Authentication
The checkpassword function in html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to bypass authentication via an empty password...
CVE-2011-4069: Improper Neutralization of Special Elements used in an LDAP Query
html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and consequently bypass authentication via a crafted username...
ignycsm.com XSS vulnerability
Open Bug Bounty ID: OBB-459363 Description| Value ---|--- Affected Website:| ignycsm.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...
PT-2017-12116
Name of the Vulnerable Software and Affected Versions dayrui FineCms version 5.0.9 Description The issue concerns a Cross Site Scripting XSS problem. It occurs in the admin/Login.php file when a specific payload is entered into the username field, provided the payload does not start with a ''...
CVE-2017-11581: Improper Neutralization of Input During Web Page Generation
dayrui FineCms 5.0.9 has Cross Site Scripting XSS in admin/Login.php via a payload in the username field that does not begin with a '' character...
CVE-2015-4658
CVE-2015-4658 is described across multiple sources as a SQL injection vulnerability in the Milw0rm Clone Script 1.0. The affected component is the admin/login.php script, with input fields (1) usr and (2) pwd used to construct SQL queries, enabling remote attackers to execute arbitrary SQL comman...
PT-2015-6658
Name of the Vulnerable Software and Affected Versions Milw0rm Clone Script version 1.0 Description The issue concerns SQL injection vulnerabilities in the admin/login.php file. Remote attackers can execute arbitrary SQL commands by manipulating the usr or pwd parameters. Recommendations For Milw0...
CVE-2015-4658: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in admin/login.php in Milw0rm Clone Script 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 usr or 2 pwd parameter...
CVE-2012-1664
Multiple cross-site scripting XSS vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to inject arbitrary web script or HTML via the 1 username parameter in a process action to admin/login.php; 2 pageTitle, 3 currentproductid, or 4 cPath parameter to...
CVE-2012-1665
Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow 1 remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or 2 remote administrators to execute arbitrary SQL commands via the status parameter to...
CVE-2012-1664: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to inject arbitrary web script or HTML via the 1 username parameter in a process action to admin/login.php; 2 pageTitle, 3 currentproductid, or 4 cPath parameter to...
CVE-2012-1665: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow 1 remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or 2 remote administrators to execute arbitrary SQL commands via the status parameter to...
PT-2015-3520
Name of the Vulnerable Software and Affected Versions osCMax versions prior to 2.5.1 Description The issue concerns SQL injection vulnerabilities in the admin panel. These vulnerabilities allow remote attackers to execute arbitrary SQL commands via specific parameters in various PHP files. For...
Nukeviet 2.0 'admin/login.php' Cookie Authentication Bypass Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/30681/info Nukeviet is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication. Attackers can exploit this vulnerability to gain...
PHPEasyData 1.5.4 - admin/login.php username Field SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/29659/info PHPEasyData is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage the cross-site scripting issues to...