CVE-2015-8623

The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time before returning, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different...

CVE-2015-8623

The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time before returning, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different...

Cross site request forgery (csrf)

The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which allows remote attackers to...

Cross site request forgery (csrf)

The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time before returning, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different...

CVE-2016-7788

SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter...

PT-2017-9343

Name of the Vulnerable Software and Affected Versions Exponent CMS versions 2.3.9 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands via the username parameter in the user.php file of the Exponent CMS framework. Recommendations For Exponent CMS versions...

CVE-2016-7788: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter...

PT-2018-9592

Name of the Vulnerable Software and Affected Versions: PHPipam versions 1.3.2 and earlier Description: The issue concerns a CWE-79 vulnerability in the /app/admin/users/print-user.php file, which can lead to code execution in the victim's browser. This can be exploited by an attacker changing the...

services.sportium.es XSS vulnerability

Vulnerable URL: https://services.sportium.es/sportium/gestor-promo-apuestas-vip/user.php?callback=prompt/OPENBUGBOUNTY/...

CVE-2016-8869

The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote attackers to gain privileges by leveraging incorrect use of unfiltered data when registering on a site...

CVE-2016-8869: Improper Input Validation

The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote attackers to gain privileges by leveraging incorrect use of unfiltered data when registering on a site...

hdwiki user.php SQL Injection Vulnerability

Interactive Wiki open source system HDwiki is by the interactive online Beijing Technology Co., Ltd. launched a free wiki Wiki building system. A SQL injection vulnerability exists in hdwiki user.php, which allows attackers to exploit the vulnerability to obtain sensitive information from the...

HDWiki 5.1 /control/user. php, etc. 2 SQL injection vulnerability

HDWiki description Interactive wiki open source systems HDWiki as China's first with independent intellectual property rights of the Chinese Wiki（Wiki）system, the interactive online（Beijing）Technology Co., Ltd. in 2006 to 11 November 28 the official launch, and strive for domestic and foreign man...

phpshe v1.1 user.php sql注入

No description provided by source...

MediaWiki 'includes/User.php' Security Bypass Vulnerability

MediaWiki is a free and free web-based Wiki engine developed and maintained by the Wikimedia Foundation and MediaWiki volunteers, which can be used to deploy in-house knowledge management and content management systems. A security bypass vulnerability exists in MediaWiki. An attacker could use th...

mpa-pro.fr XSS vulnerability

Vulnerable URL: http://www.mpa-pro.fr/auth.php?redirect=%2Fuser.php Details: Description| Value ---|--- Patched:| Yes, at 06.12.2015 Latest check for patch:| 06.12.2015 01:39 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1107271 Google Pagerank| 1 VIP website...

bcconsul.ru XSS vulnerability

Vulnerable URL: http://www.bcconsul.ru/bbs/user.php?EMAIL=--!%3E%22%3E%3C/script%20%3E%3Ciframe/onload=alert%28/XSSPOSED/%29%3E=vjkjrj Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank...

ECShop 2.5 /user.php SQL注入

No description provided by source...

CVE-2015-2271

tag/user.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/tag:flag capability before proceeding with a flaginappropriate action, which allows remote authenticated users to bypass intended access restrictions via the "Flag as...

CVE-2015-2271

tag/user.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/tag:flag capability before proceeding with a flaginappropriate action, which allows remote authenticated users to bypass intended access restrictions via the "Flag as...