CVE-2021-43650

CVE-2021-43650 Webrun = 3.6.0.42 SQLi Descrizione Webrun è un'applicazione di gestione basata sul web. Nella versione 3.6.0.42 è stato possibile identificare e segnalare una vulnerabilità di SQL Injection che si verifica durante il processo di login; più nello specifico, inietteremo il payload ne...

CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

CVE-2026-33605

An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode default for community releases, only the attacker's own connection is terminated. If running in high-performance mode default for Pro...

CVE-2021-33044

CVE-2021-33044 Exploit di bypass dell'autenticazione per dispositivi Dahua IPC/VTH/VTO Informazioni: La vulnerabilità di bypass dell'autenticazione dell'identità trovata in alcuni prodotti Dahua durante il processo di login. Gli attaccanti possono aggirare l'autenticazione dell'identità del...

CVE-2017-7921-EXPLOIT

CVE-2017-7921 - Vulnerabilidade de Autenticação Incorreta em Série de Câmeras Hikvision Uma falha de segurança identificada como CVE-2017-7921, que afeta diversos modelos de câmeras Hikvision. A vulnerabilidade foi descoberta nos dispositivos das séries DS-2CD2xx2F-I V5.2.0 build 140721 a V5.4.0...

CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

CVE-2026-42395

CVE-2026-42395 affects Dovecot (OX Dovecot by Open-Xchange, per the advisory reference). A host listed as a trusted proxy can send forwarding information containing a NUL byte , which crashes the login process on the next login attempt, causing degradation or denial of service for logins. Deploym...

EUVD-2026-67677

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

CVE-2026-42391

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...

CVE-2026-42391

Open-Xchange Dovecot is vulnerable to a denial-of-service attack in its imap-login process. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before authentication, causing disproportionate memory and CPU consumption . The resulting out-of-memory termi...

EUVD-2026-67660

An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode default for community releases, only the attacker's own connection is terminated. If running in high-performance mode default for Pro...

EUVD-2026-67576

SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...

CVE-2021-33044

CVE-2021-33044 Dahua IPC/VTH/VTO Geräte Authentifizierungs-Bypass-Exploit Über: Die Schwachstelle zur Umgehung der Identitätsauthentifizierung wurde in einigen Dahua-Produkten während des Anmeldeprozesses gefunden. Angreifer können die Geräteidentitätsauthentifizierung umgehen, indem sie bösartig...

CVE-2025-5777

CVE-2025-5777 auch bekannt als CitrixBleed 2 ist ein OOB-Read im Anmeldeprozess von Citrix Gateway. Dies ist ein Proof of Concept, der den OOB CVE-2025-5777 ausnutzt, um Speicherdaten von einer anfälligen Citrix Gateway-Instanz zu erlangen, was möglicherweise zum Diebstahl von...

CVE-2026-58450

Invoice Ninja through 5.13.26 contains an open redirect vulnerability in the client portal login that allows unauthenticated attackers to redirect authenticated victims to attacker-controlled external URLs by injecting a malicious value into the intended query parameter. Attackers can craft a...

CVE-2026-40082 Cacti: Session Fixation via missing session_regenerate_id() after login

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing sessionregenerateid after login, leading to Session Fixation. sessionregenerateid is NOT called after successful login. The login flow at authlogin.php:203-207 directly sets $SESSIONSESSUSER...

CVE-2026-45027

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, login.php hashes the submitted password with PHP hash(…, 'SHA-256') and no salt, and the password-change flow uses the same pattern. SHA-256 is a fast general-purpose hash, not ideal for password storage, so identical...

LDAP Injection

Overview Affected versions of this package are vulnerable to LDAP Injection in the login process due to improper escaping of user-supplied input before it is incorporated into LDAP search filters. An attacker can enumerate valid usernames and extract sensitive attribute data from the connected LD...

CVE-2026-44671

ZITADEL is an open source identity management platform. From 2.71.11 to before 3.4.10 and 4.15.0, a vulnerability was discovered in Zitadel's LDAP identity provider implementation, which fails to properly escape user-provided usernames before incorporating them into LDAP search filters. This allo...

CVE-2025-61669

Jupyter Server is the backend for Jupyter web applications. In jupyterserver versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in LoginFormHandler.redirectsafe, which allows redirects to arbitrary external domains via values such as ///example.com. An...