CVE-2009-5076: Improper Authentication

CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator privileges via a request with 1 login.php or 2 passwordforgotten.php appended as the PATHINFO, which bypasses a check that uses PHPSELF, which is not properl...

CVE-2010-0115: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in the GUI management console in Symantec Web Gateway 4.5 before 4.5.0.376 allows remote attackers to execute arbitrary SQL commands via the USERNAME parameter...

DGNews 2.1 SQL Injection

Remote SQL Injection Vulnerability name : DGNews v 2.1 Author : kalashnikov dork : inurl:news.php?go=fullnews&newsid admincp : admin/login.php // the user is "admin"===========MYSQL INJ======= http://localhost/pach/news.php?go=fullnews&newsid=1' =========================== Warning: mysqlnumrows:...

WordPress Register Plus Plugin Multiple Vulnerabilities

WordPress Register Plus Plugin is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

MODx login.php 'username' Parameter XSS

The installed version of MODx fails to adequately sanitize input passed to the 'username' parameter in the 'login.php' script before using it to generate dynamic HTML content. An unauthenticated, remote attacker may be able to leverage this issue to inject arbitrary HTML or script code into a...

Sql injection

Multiple SQL injection vulnerabilities in login.php in Injader 2.4.4, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 un and 2 pw parameters...

CVE-2010-4505

Multiple SQL injection vulnerabilities in login.php in Injader 2.4.4, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 un and 2 pw parameters...

CVE-2010-4505: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in login.php in Injader 2.4.4, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 un and 2 pw parameters...

MODx Revolution CMS Cross Site Scripting

getObject'modUser',array 30: 'username' = $POST'username', 31: ; ... 71: else if !empty$POST'forgotlogin' 72: $c = $modx-newQuery'modUser'; 73: $c-selectarray'modUser.','Profile.email','Profile.fullname'; 74: $c-innerJoin'modUserProfile','Profile'; 75: $c-wherearray 76: '...

CVE-2010-4402

The CVE refers to WordPress Register Plus Plugin before or at version 3.5.1, where wp-login.php exposes multiple XSS flaws. The root cause is unsanitized/reflective input in the register action, enabling remote attackers to inject arbitrary script or HTML via the 9 parameters: firstname, lastname...

CVE-2010-4402: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 firstname, 2 lastname, 3 website, 4 aim, 5 yahoo, 6 jabber, 7 about, 8 pass1, and 9 pass2 parameter...

WordPress Register Plus Plugin <= 3.5.1 - Multiple XSS

Because of these vulnerabilities in wp-login.php, the attackers can inject arbitrary web script or HTML via the "website", "aim", "yahoo", "jabber", "firstname", "lastname", "about", "pass1", and "pass2" parameters in a register action. Solution Update the plugin...

Pre Hospital Management System SQL Injection

In The Name Of GOD + Exploit Title: PRE HOSTPITAL MANAGEMENT SYSTEM SQL Bypass Vulnerability + Date: 2010-11-13 + Author : Cru3l.b0y + Software Link: http://www.preproject.com/hms.asp + Price : 750.00$ + Contact : [email protected] + Website : WwW.PenTesters.IR + Greeting: Behzad, Ahmad,...

CVE-2010-3688: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in ADMIN/login.php in NetArtMEDIA WebSiteAdmin allows remote emote attackers to include and execute arbitrary local files via directory traversal sequences in the lng parameter...

CVE-2010-3481

Multiple SQL injection vulnerabilities in login.php in ApPHP PHP MicroCMS 1.0.1, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password variables, possibly related to include/classes/Login.php. NOTE: some of these details are...

CVE-2010-3481

CVE-2010-3481 affects ApPHP PHP MicroCMS 1.0.1. It discloses multiple SQL injection vulnerabilities in login.php when magic_quotes_gpc is disabled, allowing remote attackers to potentially execute arbitrary SQL via (1) user_name and (2) password variables, possibly tied to include/classes/Login.p...

CVE-2010-3481

Multiple SQL injection vulnerabilities in login.php in ApPHP PHP MicroCMS 1.0.1, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password variables, possibly related to include/classes/Login.php. NOTE: some of these details are...

CVE-2010-3314

CVE-2010-3314 is a cross-site scripting (XSS) vulnerability in EGroupware: login.php vulnerable in EGroupware 1.4.001+.002 and 1.6.001+.002 (and EPL 9.1 pre-9.1.20100309, 9.2 pre-9.2.20100309). The lang parameter can inject arbitrary script/HTML. Affected versions include 1.6.x before 1.6.003 and...

CVE-2010-3481: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in login.php in ApPHP PHP MicroCMS 1.0.1, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password variables, possibly related to include/classes/Login.php. NOTE: some of these details are...

CVE-2010-3314: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in login.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to inject arbitrary web script or HTML via the lang parameter...