K16838: XSS vulnerability in the BIG-IP and Enterprise Manager Configuration utilities CVE-2015-1470

Security Advisory Description Using the BIGIPAuthUsernameCookie value with/tmui/login.jsp can expose a cross-site scripting XSS security flaw. CVE-2015-1470 Impact Some login.jsp parameters may allow an attacker to bypass XSS protection mechanisms by using a crafted cookie. Security Advisory Stat...

Simple Task Managing System SQL注入漏洞

Simple Task Managing System is a simple task management system. A security vulnerability exists in Simple Task Managing System version 1.0, which is caused by an SQL injection in the username and password parameters of login.php, and can be exploited by an attacker to execute arbitrary code and...

The vulnerability of Mitsubishi Electric SmartRTU’s remote terminal devices, related to the lack of protective measures for website structures, allows attackers to carry out cross-site scripting attacks.

The vulnerability of Mitsubishi Electric SmartRTU’s remote terminals lies in the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks by executing the login.php script with parameters such as userna...

Fallstudie SQL注入漏洞

Fallstudie is an application by Marcel Boehm Personal Developer. DHBW Fallstudie suffers from a SQL injection vulnerability that stems from unknown functionality in the app/config/passport.js file for component logins, where manipulation of the parameters id/email can lead to SQL injection...

CVE-2022-35605

A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters such as 'users', 'pass', etc...

CVE-2022-29596

MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a login failure and then entering the Uid=/../../../../../../../../../../../windows/win.ini%00.jpg&Pwd=anypassword&ConnMode=1&3054=Login substring for directory traversal...

CVE-2022-29317

Simple Bus Ticket Booking System v1.0 was discovered to contain multiple SQL injection vulnerbilities via the username and password parameters at /assets/partials/handleLogin.php...

CVE-2022-29317

Simple Bus Ticket Booking System v1.0 was discovered to contain multiple SQL injection vulnerbilities via the username and password parameters at /assets/partials/handleLogin.php...

Simple Bus Ticket Booking System SQL注入漏洞

Simple Bus Ticket Booking System, a bus ticket booking system, is vulnerable to a SQL injection vulnerability in version 1.0 of Simple Bus Ticket Booking System, which originates in the username and password parameters in /assets/partials/handleLogin.php. and password parameters in...

CVE-2021-44088

An SQL Injection vulnerability exists in Sourcecodester Attendance and Payroll System v1.0 which allows a remote attacker to bypass authentication via unsanitized login parameters...

Sql injection

An SQL Injection vulnerability exists in Sourcecodester Attendance and Payroll System v1.0 which allows a remote attacker to bypass authentication via unsanitized login parameters...

CVE-2021-44088

An SQL Injection vulnerability exists in Sourcecodester Attendance and Payroll System v1.0 which allows a remote attacker to bypass authentication via unsanitized login parameters...

HGiga MailSherlock 跨站脚本漏洞

HGiga MailSherlock is an email archiving and auditing system that provides a complete email security solution. A cross-site scripting vulnerability exists in HGiga MailSherlock. The vulnerability stems from MailSherlock not validating user parameters on multiple login pages. An attacker can explo...

GaussDB Kernel: Authentication Parameters

Set login parameters for scanning GaussDB Kernel database. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...

CVE-2019-17128

Netreo OmniCenter through 12.1.1 allows unauthenticated SQL Injection Boolean Based Blind in the redirect parameters and parameter name of the login page through a GET request. The injection allows an attacker to read sensitive information from the database used by the application...

CVE-2018-17053

Cross-site scripting XSS vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to login request parameters, a different vulnerability than CVE-2018-17054...

CVE-2018-17054

Cross-site scripting XSS vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to login request parameters, a different vulnerability than CVE-2018-17053...

ruibaby Halo Stored Cross-Site Scripting Vulnerability

ruibaby Halo is a Java-based blogging system. A stored cross-site scripting vulnerability exists in ruibaby Halo 0.0.2. An attacker can exploit this vulnerability by using the loginName and loginPwd parameters of AdminController.java to conduct a cross-site scripting attack...

Micro Focus NetIQ Access Manager Cross-Site Scripting Vulnerability

Micro Focus NetIQ Access Manager is a resource access control solution from Micro Focus UK. The solution provides multiple authentication, data encryption, single sign-on and SSL VPN for local and remote users. A cross-site scripting vulnerability exists in the handling of ESP login parameters in...

CVE-2017-8225

On Wireless IP Camera P2P WIFICAM devices, access to .ini files containing credentials is not correctly checked. An attacker can bypass authentication by providing an empty loginuse parameter and an empty loginpas parameter in the URI...