CVE-2019-19484: URL Redirection to Untrusted Site

Open redirect via parameter ‘p’ in login.php in Centreon 19.04.4 and below allows an attacker to craft a payload and execute unintended behavior...

Cross site scripting

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-failed-login.php by adding a question mark ? followed by the payload...

CVE-2020-10447: Improper Neutralization of Input During Web Page Generation

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-failed-login.php by adding a question mark ? followed by the payload...

Cross site scripting

Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element...

CVE-2020-6850

Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element...

CVE-2020-6850

Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element...

CVE-2020-6850: Improper Neutralization of Input During Web Page Generation

Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element...

PT-2020-19264

Name of the Vulnerable Software and Affected Versions miniorange-saml-20-single-sign-on plugin versions prior to 4.8.84 Description The issue allows for XSS via a crafted SAML XML Response to "wp-login.php". This is related to the SAMLResponse and RelayState variables, and the Destination paramet...

Design/Logic Flaw

bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter...

CVE-2019-20173

The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...

Design/Logic Flaw

The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...

CVE-2019-20173

The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...

PT-2020-7094

Name of the Vulnerable Software and Affected Versions bbPress versions 1.0.0 through 1.0.2 Description The issue concerns a cross-site scripting XSS flaw in the /bb-login.php URL, specifically via the re parameter. This allows for potential malicious script injection. No information is provided...

PT-2020-10357

Name of the Vulnerable Software and Affected Versions Auth0 wp-auth0 plugin versions 3.11.x through 3.11.2 Description The issue allows for XSS via a wle parameter associated with the "wp-login.php" endpoint. This affects the Auth0 wp-auth0 plugin for WordPress. Recommendations For Auth0 wp-auth0...

CVE-2019-20173: Improper Neutralization of Input During Web Page Generation

The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...

CVE-2011-1150: Improper Neutralization of Input During Web Page Generation

bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter...

Auth0 < 3.11.3 - Unauthenticated Reflected XSS via wle Parameter

XSS via a wle parameter associated with wp-login.php. PoC WP/wp-login.php?wle=%22%20onEvent%3DX186697040Y2Z%20...

PT-2020-19936

Name of the Vulnerable Software and Affected Versions UseBB version 1.0.12 Description The issue allows for a login bypass due to type juggling in the panel login.php file. This occurs because the != operator is used instead of !== for password hashes, leading to mishandling of hashes that begin...

elaniin CMS 1.0 - Authentication Bypass

Exploit Title: elaniin CMS 1.0 - Authentication Bypass Author: riamloo Date: 2020-01-02 Vendor Homepage: https://elaniin.com/ github == https://github.com/elaniin/ Software Link: https://github.com/elaniin/CMS/archive/master.zip Version: 1 CVE: N/A Tested on: Win 10 Discription: Open-source Conte...

BloodX 1.0 SQL Injection

Exploit Title: BloodX 1.0 - Authentication Bypass Author: riamloo Date: 2019-12-31 Vendor Homepage: https://github.com/diveshlunker/BloodX Software Link: https://github.com/diveshlunker/BloodX/archive/master.zip Version: 1 CVE: N/A Tested on: Win 10 Discription: An standalone platform which lets...