15 matches found
Potential log injection in reset user endpoint in CKAN
A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. PatchesThis has been fixed in the CKAN 2.9.11 and 2.10.4 versions WorkaroundsOverride the...
CVE-2026-33883
Statamic is a Laravel and Git powered content management system CMS. Prior to versions 5.73.16 and 6.7.2, the user:resetpasswordform tag could render user-input directly into HTML without escaping, allowing an attacker to craft a URL that executes arbitrary JavaScript in the victim's browser. Thi...
MiracleLinux 8 : postgresql:13 (AXSA:2024-9054:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-9054:01 advisory. postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID CVE-2024-10978 postgresql: PostgreSQL PL/Perl environment variable...
EUVD-2024-54657
Malicious code in bioql PyPI...
CVE-2025-57146: Improper Neutralization of Special Elements used in an SQL Command
phpgurukul Complaint Management System in PHP 2.0 is vulnerable to SQL Injection in user/reset-password.php via the mobileno parameter...
CVE-2024-11965: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in PHPGurukul Complaint Management system 1.0 and classified as critical. This vulnerability affects unknown code of the file /user/reset-password.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit h...
PT-2024-21647
Name of the Vulnerable Software and Affected Versions CKAN versions prior to 2.9.11 CKAN versions prior to 2.10.4 Description A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log...
CVE-2024-27097: Insertion of Sensitive Information into Log File
A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade...
Design/Logic Flaw
The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including, 7.5.4. This is due to a lack of validation checks within login.php. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to reset th...
CVE-2021-42000
When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password...
Nagios XI 5.2.6-5.4.12 - Chained Remote Code Execution (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Nagios XI Chained Remote Code Execution', 'Description' = %q This module exploits a few different vulnerabilities in Nagios XI 5.2.6-5.4.12 to ga...
About SSV-ID: 4 4 7 4 POC analysis and reflection-vulnerability warning-the black bar safety net
SSV-ID: 4 4 7 4 SSV-AppDir: Discuz! Vulnerability Published: 2008-11-21 GMT+0 8 0 0 URL: http://sebug.net/vuldb/ssvid-4474 A very old vulnerability, just as the study of penetration of a material of the bale, with its poc, the direct can be used, it feel so magical at the same time want to analyz...
PHP Classifieds Remote User Reset Password Vulnerability
Exploit for php platform in category web applications Exploit Title: PHP Classifieds Remote User Reset Password Vulnerability Google Dork: allintext: Welcome to PHP Classifieds Date: 23/03/2011 Author: Daniel Godoy Author Mail: DanielGodoyatGobiernoFederaldotcom Author Web:...
PHP MatchMaker Remote User Reset Password Vulnerability
Exploit for php platform in category web applications Exploit Title : PHP MatchMaker Remote User Reset Password Vulnerability Google Dork: allintext: Powered by PHP MatchMaker Date: 23/03/2011 Author: Daniel Godoy Author Mail: DanielGodoyatGobiernoFederaldotcom Author Web:...
