CVE-2019-1010287

Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may...

CVE-2019-19325

SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS Cross-Site Scripting on some forms buil...

CVE-2019-13235

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form...

CVE-2019-12372

Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form...

CVE-2019-13448

An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could exploit the vulnerable function in order to prepare an XSS payload to send to the product's clients...

CVE-2019-19517

Intelbras RF1200 1.1.3 devices allow CSRF to bypass the login.html form, as demonstrated by launching a scrapy process...

CVE-2018-20218

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without any kind of escaping or validation in /usr/share/www/check.lp file. An attacker is able to perform command injection using the "password" parameter...

CVE-2014-8534

Unspecified vulnerability in the login form in McAfee Network Data Loss Prevention NDLP before 9.2.2 allows local users to cause a denial of service via a crafted value in the domain field...

CVE-2016-10872

The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form...

CVE-2002-2035

SQL injection vulnerability in RealityScape MyLogin 2000 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the 1 Username or 2 Password in the login form...

CVE-2025-44024

Cross-Site Scripting XSS vulnerability was discovered in the Pichome system v2.1.0 and before. The vulnerability exists due to insufficient sanitization of user input in the login form. An attacker can inject malicious JavaScript code into the username or password fields during the login process...

CVE-2025-44024: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability was discovered in the Pichome system v2.1.0 and before. The vulnerability exists due to insufficient sanitization of user input in the login form. An attacker can inject malicious JavaScript code into the username or password fields during the login process...

PT-2025-21236 · Pichome · Pichome

Name of the Vulnerable Software and Affected Versions: Pichome system versions prior to 2.1.0 Description: A Cross-Site Scripting XSS issue was found due to insufficient sanitization of user input in the login form. This allows an attacker to inject malicious JavaScript code into the username or...

Pichome 跨站脚本漏洞

Pichome is a powerful open source web hosting program for image and media file management by individual developer zyx0814. A security vulnerability exists in Pichome 2.1.0 and prior versions, which stems from insufficient cleaning of user input in the login form and could lead to a cross-site...

CVE-2025-3840

CVE-2025-3840 describes an XSS in the End of Life OVA Connect Installer component (Saviynt EOL OVA). The vulnerability stems from improper neutralization of input in the login form’s action parameter, enabling injected scripts under certain conditions. The component is deprecated since Sep 2023 w...

CVE-2025-3840: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input vulnerability was identified in the End of Life EOL OVA based connect installer component which is deployed for installation purposes in a customer network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. An...

CVE-2024-10088

Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS Cross-site Scripting attacks. An attacker might trick a user into filling a login form with a malicious script, what causes the script to run in user's context. This vulnerability has been patched in...

PT-2025-16226

Name of the Vulnerable Software and Affected Versions: SoftCOM iKSORIS Internet Starter versions prior to 79.0 Description: The issue is related to Reflected XSS Cross-site Scripting attacks. An attacker might trick a user into filling a login form with a malicious script, which causes the script...

CVE-2024-10088: Improper Neutralization of Input During Web Page Generation

Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS Cross-site Scripting attacks. An attacker might trick a user into filling a login form with a malicious script, what causes the script to run in user's context. This vulnerability has been patched in...

CVE-2025-3282: Authorization Bypass Through User-Controlled Key

The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the userregistrationmembershipregistermember due to missing validation on the...