Design/Logic Flaw

The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors...

CVE-2009-0662

The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors...

Clan Tiger CMS 1.1.1 SQL Injection

----------------------------------------------------------- CLAN TIGER CMS AUTH BYPASS LOGIN FORM SQL INJECTION ----------------------------------------------------------- CMS INFORMATION: --WEB: http://www.clantiger.com --DOWNLOAD: http://www.clantiger.com/download-clan-cms --DEMO:...

ClanTiger <= 1.1.1 (Auth Bypass) SQL Injection Vulnerability

Exploit for unknown platform in category web applications ============================================================ ClanTiger WEB: http://www.clantiger.com | |--DOWNLOAD: http://www.clantiger.com/download-clan-cms | |--DEMO: http://www.demo.clantiger.com/ | |--CATEGORY: CMS / Portals |...

BlueBird Pre-Release SQL Injection

0x01 Informations: Name : BlueBird Pre-Release Download : http://downloads.sourceforge.net/bluebird/bluebirdpre.zip Vulnerability : Auth Bypass Author : x0r Contact : [email protected] Notes : Proud to be Italian 0x02 Bug: Bugged file is /path/login.php Code if $request == "POST" $username =...

CVE-2008-3098

Cross-site scripting XSS vulnerability in admin/usercheck.php in fuzzylime cms before 3.03 allows remote attackers to inject arbitrary web script or HTML via the user parameter to the login form...

CVE-2008-3098

CVE-2008-3098 is a Cross-site scripting (XSS) flaw in fuzzylime CMS prior to 3.03 affecting admin/usercheck.php. The vulnerability allows remote attackers to inject arbitrary script via the login form's user parameter. According to the CVE notes, vendor remediation released version 3.03 on 2008-0...

CVE-2006-7233

Openfire (formerly Wildfire) 2.6.0 admin console login.jsp suffers a Cross-site Scripting (XSS) vulnerability. The issue allows remote attackers to inject arbitrary web script or HTML via the url parameter, potentially affecting versions prior to 3.5.3. The description does not specify a concrete...

CVE-2005-4876

Cross-site scripting XSS vulnerability in the login form login.jsp of the admin console in Openfire formerly Wildfire 2.2.2, and possibly other versions before 2.3.0 Beta 2, allows remote attackers to inject arbitrary web script or HTML via the username parameter, a different vulnerability than...

CVE-2005-4877

Cross-site scripting XSS vulnerability in the login form login.jsp of the admin console in Openfire formerly Wildfire 2.3.0 Beta 2 allows remote attackers to inject arbitrary web script or HTML via Javascript events in the username parameter, a different vulnerability than CVE-2005-4876...

CVE-2005-4876

The CVE describes an XSS in Openfire’s admin console login.jsp. Affected: Openfire (Wildfire) 2.2.2, and possibly earlier than 2.3.0 Beta 2. The vulnerability arises from improper handling of the username parameter, allowing remote attackers to inject arbitrary script/HTML. This is a component-le...

CVE-2005-4877

Openfire 2.3.0 Beta 2 (formerly Wildfire) is affected by CVE-2005-4877, a cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console. The issue arises from the username parameter, where remote attackers can inject arbitrary web script or HTML via Javascript events...

PYSEC-2008-1

Cross-site scripting XSS vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request...

CVE-2008-2302

Cross-site scripting XSS vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request...

DEBIAN-CVE-2008-2302

Cross-site scripting XSS vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request...

PYSEC-2008-1

Cross-site scripting XSS vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request...

CVE-2008-2302

Cross-site scripting XSS vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request...

CVE-2008-2302

Cross-site scripting XSS vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request...

FreeBSD : django -- XSS vulnerability (f49ba347-2190-11dd-907c-001c2514716c)

Django project reports : The Django administration application will, when accessed by a user who is not sufficiently authenticated, display a login form and ask the user to provide the necessary credentials before displaying the requested page. This form will be submitted to the URL the user...

Django Administration Application Login Form XSS

The remote host is using Django, a high-level Python web framework designed for rapid development of database-driven websites. The administration application included with the version of Django installed on the remote host fails to sanitize the URL before using it to generate dynamic HTML output...