CVE-2009-3758: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-3543: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in phenotype/admin/login.php in Phenotype CMS before 2.9 allows remote attackers to execute arbitrary SQL commands via the user parameter aka the login name...

CVE-2009-3422

login.php in Zenas PaoLiber 1.1, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

Authentication flaw

login.php in Zenas PaoLink 1.0, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

CVE-2009-3430

The CVE-2009-3430 entry concerns Allomani Mobile 2.5, where a SQL injection flaw in login.php allows remote attackers to manipulate the database by supplying crafted input in the username field during login. The vulnerability is caused by unsafely handling user input in the login action, enabling...

CVE-2009-3423

CVE-2009-3423 affects Zenas PaoLink 1.0. When login_globals is enabled, an attacker can bypass authentication by setting the login_ok parameter to 1 in login.php, gaining administrative access. The NVD entry records a CVSSv2 base score of 6.8 (MEDIUM) with network attack vector and no authenticat...

CVE-2009-3423

login.php in Zenas PaoLink 1.0, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

CVE-2009-3422

login.php in Zenas PaoLiber 1.1, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

CVE-2009-3421

CVE-2009-3421 affects Zenas PaoBacheca Guestbook 2.1. The vulnerability is in login.php and arises when PHP register_globals is enabled. An attacker can bypass authentication and gain administrative access by setting the login_ok parameter to 1. The NVD notes a high-severity impact (confidentiali...

CVE-2009-3430: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in Allomani Mobile 2.5 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action...

CVE-2009-3423: Improper Authentication

login.php in Zenas PaoLink 1.0, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

CVE-2009-3421: Improper Authentication

login.php in Zenas PaoBacheca Guestbook 2.1, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

CVE-2009-3422: Improper Authentication

login.php in Zenas PaoLiber 1.1, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

CVE-2009-3327

Multiple SQL injection vulnerabilities in WX-Guestbook 1.1.208 allow remote attackers to execute arbitrary SQL commands via the 1 QUERY parameter to search.php and 2 USERNAME parameter to login.php. NOTE: some of these details are obtained from third party information...

CVE-2009-3327: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in WX-Guestbook 1.1.208 allow remote attackers to execute arbitrary SQL commands via the 1 QUERY parameter to search.php and 2 USERNAME parameter to login.php. NOTE: some of these details are obtained from third party information...

CVE-2009-3218: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in control/login.php in AR Web Content Manager AWCM 2.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter...

PHP168 6.0及以下版本login.php存在重大安全漏洞

PHP168整站系统一直以来受广大用户的亲睐，它凭借着自身的强大、稳定、安全、灵活、易用等多方面的优势 ... 架构与功能的不断完善，让PHP168成为了最主流CMS系统之一。 login.php参数处理不当，入侵者可以在用户登陆页面构造特殊语句，将PHP一句话写入cache目录，从而获得使用PHP168整站程序网站的WEBSHELL权限。 PHP168 6.0以下版本 暂无 等待官方补丁 login.php?makehtml=1&chdbhtmlname=honker.php&chdbpath=cache&content=?php%20@eval$POSThonker;?...

CVE-2009-3066: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in PropertyWatchScript.com Property Watch 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 videoid parameter to tools/email.php and 2 redirect parameter to tools/login.php...

Property Watch 2.0 Cross Site Scripting

/ | | \ \ / / | | \ \ / / | |\ \ /\ / / | | | | | | \ V /| | | \ V V / | | || | || / ||| // ,|, | |/ | | | |/ / | ' \ | | / | | | | | | | |||,|| || || Property Watch v2.0 Remote XSS Vulnerabilities Discovered By : Moudi Contact : Download : http://www.propertywatchscript.com/ Greetings :...

CVE-2009-2928

CVE-2009-2928 is an XSS vulnerability in TGS Content Management 0.x, specifically in login.php, where the parameter previous_page can inject arbitrary script/HTML. This entry is supported by NVD details (description of XSS via previous_page) and does not include explicit exploit status or a publi...