eLearning V2(by: oretnom23) is vulnerable from remote SQL-Injection-Bypass-Authentication

Description: The eLearning V2by: oretnom23 is vulnerable from remote SQL-Injection-Bypass-Authentication in 3 accounts of the system admin, Faculty & Student in app /elearning/classes/Login.php. remote SQL-Injection-Bypass-Authentication: . The parameter username, facultyid, and studentid from th...

Online Leave Management System 1.0 SQL Injection

Exploit Title: OLMS - PHP by: oretnom23 v1.0 SQL-Injection-Bypass-Authentication in /leavesystem/classes/Login.php. Author: nu11secur1ty Testing and Debugging: nu11secur1ty Date: 08.31.2021 Vendor: https://www.sourcecodester.com/php/14910/online-leave-management-system-php-free-source-code.html...

SES-by-oretnom23 -v1.0-SQL-Injection-bypass-Login

The SES-byoretnom23 -v1.0 is vulnerable in the application /elearning/classes/Login.php which is called from /elearning/dist/js/script.js app. The parameter username from the login form is not protected correctly and there is no security and escaping from malicious payloads. When the user is...

EyouCMS Cross-site Request Forgery Vulnerability

EyouCMS is an open source content management system CMS based on ThinkPHP.EyouCMS suffers from a cross-site request forgery vulnerability, which stems from a cross-site request forgery CSRF vulnerability in EyouCMS 1.3.6. An attacker could use the vulnerability to execute js code by adding an htm...

CVE-2020-20642

Cross Site Request Forgery CSRF vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn...

CVE-2020-20642: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn...

CVE-2020-23148: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request...

Cross site scripting

Cross Site Scripting XSS vulnerability in gnuboard5 =v5.3.2.8 via the url parameter to bbs/login.php...

CVE-2020-18661: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in gnuboard5 =v5.3.2.8 via the url parameter to bbs/login.php...

MetInfo Cross-Site Scripting Vulnerability (CNVD-2021-49143)

MetInfo is a Content Management System CMS developed using PHP and Mysql. A cross-site scripting vulnerability exists in MetInfo. The vulnerability can be exploited to conduct cross-site scripting attacks via the gourl parameter in login.php...

CVE-2020-22165

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...

CVE-2020-22165: Improper Neutralization of Special Elements used in an SQL Command

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...

Cross site scripting

Cross Site Scripting XSS vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php...

CVE-2020-21517

Cross Site Scripting XSS vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php...

CVE-2020-21517

MetInfo 7.0.0 is affected by a Cross‑Site Scripting (XSS) vulnerability exploitable via the gourl parameter in login.php. The issue is identified as CVE-2020-21517. Provided sources consistently describe the vulnerable entry as MetInfo’s login flow accepting gourl input that can be manipulated to...

CVE-2020-21517: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php...

PT-2021-10638

Name of the Vulnerable Software and Affected Versions: MetInfo version 7.0.0 Description: A Cross Site Scripting XSS issue exists via the gourl parameter in the "login.php" endpoint. Recommendations: For MetInfo version 7.0.0, update the software to a version that fixes this issue, or as a...

CVE-2020-29214: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in SourceCodester Alumni Management System 1.0 allows the user to inject SQL payload to bypass the authentication via admin/login.php...

CVE-2021-31738

Adiscon LogAnalyzer 4.1.10 and 4.1.11 allow login.php XSS...

Adiscon LogAnalyzer 跨站脚本漏洞

Adiscon LogAnalyzer is a set of web front-end tools for system logs and other network event data. The tool provides log browsing, search and basic analysis, and graphical display. A security vulnerability exists in Adiscon LogAnalyzer 4.1.10 and 4.1.11 that allows login.php to execute XSS...