CVE-2023-37068: Improper Neutralization of Special Elements used in an SQL Command

Code-Projects Gym Management System V1.0 allows remote attackers to execute arbitrary SQL commands via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username and password field...

PT-2023-25781 · Code Projects · Code-Projects Gym Management System

Name of the Vulnerable Software and Affected Versions: Code-Projects Gym Management System version V1.0 Description: The issue allows remote attackers to execute arbitrary SQL commands via the login form, leading to unauthorized access and potential data manipulation. This arises due to...

Information Disclosure

sulu/sulu is vulnerable to Observable Response Discrepancy. The vulnerability exists due to the insecure access control used in the security.yaml configuration, which allows an attacker to detect whether a user's username or email exists and which ones do not exist through the Admin Login form...

CVE-2023-39343

Sulu is an open-source PHP content management system based on the Symfony framework. It allows over the Admin Login form to detect which user username, email exists and which one do not exist. Sulu Installation not using the old Symfony 5.4 security System and previous version are not impacted by...

CVE-2023-39343: Observable Response Discrepancy

Sulu is an open-source PHP content management system based on the Symfony framework. It allows over the Admin Login form to detect which user username, email exists and which one do not exist. Sulu Installation not using the old Symfony 5.4 security System and previous version are not impacted by...

PT-2023-26890

Name of the Vulnerable Software and Affected Versions Sulu versions 2.5.0 through 2.5.9 Description The issue allows detection of existing and non-existing users through the Admin Login form, potentially revealing sensitive information about user accounts. This is possible due to the way the syst...

CVE-2023-37791

D-Link DIR-619L v2.04TW was discovered to contain a stack overflow via the curTime parameter at /goform/formLogin...

CVE-2023-2869

The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the dofieldreorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorde...

PT-2023-21906 · WordPress · Wp-Members Membership

Name of the Vulnerable Software and Affected Versions: WP-Members Membership plugin for WordPress versions up to, and including, 3.4.7.3 Description: The issue arises from a missing capability check on the do field reorder function, allowing authenticated attackers with subscriber-level access to...

CVE-2023-22583 SQL Injection in Danfoss AK-EM100

The Danfoss AK-EM100 web forms allow for SQL injection in the login forms...

Danfoss AK-EM100 web applications SQL注入漏洞

Danfoss AK-EM100 web applications is a web application from Danfoss, Denmark. It provides a web-based graphical user interface to the store that allows a range of everyday users to locally or remotely monitor data, alarms, and reports on all of their refrigeration equipment. A security...

PT-2023-18827

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions up to, and including, 3.2.70 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'wpdm members', 'wpdm login form', 'wpdm reg...

The vulnerability of the /goform/formLogin component in the D-Link DIR-816 A2 microprogramming router software allows a hacker to execute arbitrary code.

The vulnerability of the /goform/Diagnosis component of D-Link DIR-816 A2 microprogrammed software lies in the writing of data beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

CraftCMS Administration Panel Login Form Detected

CraftCMS Administration Panel has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative functionality. No...

CVE-2023-29836

Cross Site Scripting vulnerability found in Exelysis Unified Communication Solutions EUCS v.1.0 allows a remote attacker to execute arbitrary code via the Username parameter of the eucsAdmin login form...

Cross site scripting

Cross Site Scripting vulnerability found in Exelysis Unified Communication Solutions EUCS v.1.0 allows a remote attacker to execute arbitrary code via the Username parameter of the eucsAdmin login form...

CVE-2023-29836

Cross Site Scripting vulnerability found in Exelysis Unified Communication Solutions EUCS v.1.0 allows a remote attacker to execute arbitrary code via the Username parameter of the eucsAdmin login form...

Exelysis Unified Communication Solutions 跨站脚本漏洞

Exelysis Unified Communication Solutions EUCS is a unified communication solution from Exelysis. A security vulnerability exists in Exelysis Unified Communication Solutions EUCS version 1.0. An attacker could exploit the vulnerability to execute arbitrary code via the Username parameter of the...

CVE-2023-29836: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability found in Exelysis Unified Communication Solutions EUCS v.1.0 allows a remote attacker to execute arbitrary code via the Username parameter of the eucsAdmin login form...

PT-2023-22436 · Exelysis · Exelysis Unified Communication Solution

Name of the Vulnerable Software and Affected Versions: Exelysis Unified Communication Solutions EUCS version 1.0 Description: A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the Username parameter of the "eucsAdmin login form" API endpoint. Recommendations: For...