CVE-2020-35710

Parallels Remote Application Server RAS 18 allows remote attackers to discover an intranet IP address because submission of the login form even with blank credentials provides this address to the attacker's client for use as a "host" value. In other words, after an attacker's web browser sent a...

CVE-2018-1000826

Microweber version = 1.0.7 contains a Cross Site Scripting XSS vulnerability in Admin login form template that can result in Execution of JavaScript code...

CVE-2010-1453

Cross-site scripting XSS vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the formurl parameter...

CVE-2019-1010287

Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may...

CVE-2019-19325

SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS Cross-Site Scripting on some forms buil...

CVE-2019-13235

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form...

CVE-2019-12372

Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form...

CVE-2019-13448

An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could exploit the vulnerable function in order to prepare an XSS payload to send to the product's clients...

CVE-2019-19517

Intelbras RF1200 1.1.3 devices allow CSRF to bypass the login.html form, as demonstrated by launching a scrapy process...

CVE-2018-20218

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without any kind of escaping or validation in /usr/share/www/check.lp file. An attacker is able to perform command injection using the "password" parameter...

CVE-2014-8534

Unspecified vulnerability in the login form in McAfee Network Data Loss Prevention NDLP before 9.2.2 allows local users to cause a denial of service via a crafted value in the domain field...

CVE-2016-10872

The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form...

CVE-2002-2035

SQL injection vulnerability in RealityScape MyLogin 2000 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the 1 Username or 2 Password in the login form...

CVE-2025-44024

Cross-Site Scripting XSS vulnerability was discovered in the Pichome system v2.1.0 and before. The vulnerability exists due to insufficient sanitization of user input in the login form. An attacker can inject malicious JavaScript code into the username or password fields during the login process...

PT-2025-21236 · Pichome · Pichome

Name of the Vulnerable Software and Affected Versions: Pichome system versions prior to 2.1.0 Description: A Cross-Site Scripting XSS issue was found due to insufficient sanitization of user input in the login form. This allows an attacker to inject malicious JavaScript code into the username or...

Pichome 跨站脚本漏洞

Pichome is a powerful open source web hosting program for image and media file management by individual developer zyx0814. A security vulnerability exists in Pichome 2.1.0 and prior versions, which stems from insufficient cleaning of user input in the login form and could lead to a cross-site...

CVE-2025-3840

CVE-2025-3840 describes an XSS in the End of Life OVA Connect Installer component (Saviynt EOL OVA). The vulnerability stems from improper neutralization of input in the login form’s action parameter, enabling injected scripts under certain conditions. The component is deprecated since Sep 2023 w...

CVE-2024-10088

Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS Cross-site Scripting attacks. An attacker might trick a user into filling a login form with a malicious script, what causes the script to run in user's context. This vulnerability has been patched in...

PT-2025-16226 · Softcom · Softcom Iksoris Internet Starter

Name of the Vulnerable Software and Affected Versions: SoftCOM iKSORIS Internet Starter versions prior to 79.0 Description: The issue is related to Reflected XSS Cross-site Scripting attacks. An attacker might trick a user into filling a login form with a malicious script, which causes the script...

Silverstripe Framework user enumeration via timing attack on login and password reset forms

Impact User enumeration is possible by performing a timing attack on the login or password reset pages with user credentials. This was originally disclosed in https://www.silverstripe.org/download/security-releases/ss-2017-005/ for CMS 3 but was not patched in CMS 4+ References -...