Insecure Random Number Generator

phpservermon/phpservermon uses an insecure random number generator. The vulnerability exists in the generatePasswordResetToken function of User.php because of the insecure mtrand random number generator function which allows an attacker to guess the reset password hashes...

Insecure Random Number Generator

phpservermon/phpservermon uses an insecure random number generator. The vulnerability exists because of the insecure mtrand random number generator function in the loginWithCookieData function of User.php, allowing an attacker to guess the strings it generates...

PHPServerMon PRNG has Insufficient Entropy

A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the public and may b...

CVE-2021-4241

A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the public and may b...

CVE-2021-4241 phpservermon User.php setUserLoggedIn predictable algorithm in random number generator

A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the public and may b...

CVE-2021-4240 phpservermon User.php generatePasswordResetToken predictable algorithm in random number generator

A vulnerability, which was classified as problematic, was found in phpservermon. This affects the function generatePasswordResetToken of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the publ...

PT-2022-10699 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SEMCMS version 1.2 Description: The issue is related to SQL Injection via the SEMCMS User.php file. Recommendations: For SEMCMS version 1.2, update to a version that fixes the SQL Injection issue in SEMCMS User.php...

Yii Framework Cross-Site Request Forgery (CSRF)

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity...

Moodle does not consider the moodle/tag:flag capability

tag/user.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/tag:flag capability before proceeding with a flaginappropriate action, which allows remote authenticated users to bypass intended access restrictions via the "Flag as...

GHSA-6VC5-V7HW-H5H2 Cross-site Scripting in RosarioSIS

RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php...

Cross-site Scripting in RosarioSIS

RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php...

Simple Forum-Discussion System SQL Injection Vulnerability

Simple Forum-Discussion System is a simple forum/discussion system. SQL injection vulnerability exists in Simple Forum-Discussion System, which originates in various components such as manage topic.php, manage user.php and ajax.php. Lack of validation of externally entered SQL statements. An...

CVE-2021-41696

An authentication bypass account takeover vulnerability exists in Premiumdatingscript 4.2.7.7 due to a weak password reset mechanism in requests\user.php...

CVE-2021-41694

An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in requests\user.php...

CVE-2021-41694: Use of Insufficiently Random Values

An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in requests\user.php...

CVE-2021-41696: Weak Password Requirements

An authentication bypass account takeover vulnerability exists in Premiumdatingscript 4.2.7.7 due to a weak password reset mechanism in requests\user.php...

Design/Logic Flaw

An issue in the component route\user.php of Xiuno BBS v4.0.4 allows attackers to enumerate usernames...

CVE-2020-21493: Undefined Security Weakness

An issue in the component route\user.php of Xiuno BBS v4.0.4 allows attackers to enumerate usernames...

PT-2021-10414 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2018 Description: A remote code execution issue in the template user.php file allows attackers to execute arbitrary PHP code. This is achieved via the ml and title parameters. Recommendations: For ZZCMS version 2018, consider...

CASAP Automated Enrollment Cross-Site Scripting Vulnerability (CNVD-2021-57776)

CASAP Automated Enrollment is an automated enrollment system for the CASAP organization in the United States. The purpose of the project is to provide CASAP with an automated enrollment system to streamline the school process and make it more effective, efficient and easy to retrieve...