Design/Logic Flaw

phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter...

CVE-2020-27163

phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter...

CVE-2020-27163: Improper Neutralization of Input During Web Page Generation

phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter...

CVE-2020-25006

Heybbs v1.2 has a SQL injection vulnerability in login.php file via the username parameter which may allow a remote attacker to execute arbitrary code...

Sql injection

Heybbs v1.2 has a SQL injection vulnerability in login.php file via the username parameter which may allow a remote attacker to execute arbitrary code...

CVE-2020-25006

Heybbs v1.2 has a SQL injection vulnerability in login.php file via the username parameter which may allow a remote attacker to execute arbitrary code...

CVE-2020-25006

The CVE-2020-25006 entry concerns Heybbs v1.2, with a SQL injection vulnerability in login.php via the username parameter that may allow a remote attacker to execute arbitrary code. The affected component is the login logic in Heybbs 1.2; underlying cause is a SQL injection flaw in user authentic...

CVE-2020-25006: Improper Neutralization of Special Elements used in an SQL Command

Heybbs v1.2 has a SQL injection vulnerability in login.php file via the username parameter which may allow a remote attacker to execute arbitrary code...

elaniin CMS - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: elaniin CMS 1.0 - Authentication Bypass Exploit Author: BKpatron Vendor Homepage:https://elaniin.com/ Software Link:https://github.com/elaniin/CMS/archive/master.zip Version: v1.0 Tested on: Win 10 CVE: N/A Vulnerability: Attack...

CVE-2020-14973: Improper Neutralization of Input During Web Page Generation

The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting XSS vulnerability via the query string...

CVE-2020-12273

In TestLink 1.9.20, a crafted login.php viewer parameter exposes cleartext credentials...

CVE-2020-12273: Missing Encryption of Sensitive Data

In TestLink 1.9.20, a crafted login.php viewer parameter exposes cleartext credentials...

CVE-2020-11545: Improper Neutralization of Special Elements used in an SQL Command

Project Worlds Official Car Rental System 1 is vulnerable to multiple SQL injection issues, as demonstrated by the email and parameters account.php, uname and pass parameters login.php, and id parameter bookcar.php This allows an attacker to dump the MySQL database and to bypass the login...

CVE-2019-19484

Open redirect via parameter ‘p’ in login.php in Centreon 19.04.4 and below allows an attacker to craft a payload and execute unintended behavior...

CVE-2019-19484

CVE-2019-19484 affects Centreon prior to version 19.04.5 (19.04.4 and below) and is due to an open redirect in login.php via the p URL parameter. An attacker can craft a payload to trigger unintended behavior by redirecting to an arbitrary URL. The linked records (including Red Hat advisory refer...

Centreon Input Validation Error Vulnerability (CNVD-2020-21242)

Centreon Merethis Centreon is a set of open source system monitoring tools from the French company Centreon . The product mainly provides monitoring functions on the network , system and application resources . An input validation error vulnerability exists in Centreon 19.04.4 and earlier version...

CVE-2019-19484: URL Redirection to Untrusted Site

Open redirect via parameter ‘p’ in login.php in Centreon 19.04.4 and below allows an attacker to craft a payload and execute unintended behavior...

Cross site scripting

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-failed-login.php by adding a question mark ? followed by the payload...

CVE-2020-10447: Improper Neutralization of Input During Web Page Generation

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-failed-login.php by adding a question mark ? followed by the payload...

Cross site scripting

Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element...