CVE-2021-21337

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a differe...

PT-2021-14431

Name of the Vulnerable Software and Affected Versions Products.PluggableAuthService versions prior to 2.6.1 Description The issue is an open redirect vulnerability, where a maliciously crafted link to the login form and login functionality could redirect the browser to a different website...

Code injection

A username enumeration issue was discovered in SquaredUp before version 4.6.0. The login functionality was implemented in a way that would enable a malicious user to guess valid username due to a different response time from invalid usernames...

CVE-2020-9389: Observable Discrepancy

A username enumeration issue was discovered in SquaredUp before version 4.6.0. The login functionality was implemented in a way that would enable a malicious user to guess valid username due to a different response time from invalid usernames...

PT-2021-12849

Name of the Vulnerable Software and Affected Versions: SquaredUp versions prior to 4.6.0 Description: A username enumeration issue was discovered in the login functionality, allowing a malicious user to guess valid usernames due to different response times from invalid usernames. Recommendations:...

CVE-2020-28133

An issue was discovered in SourceCodester Simple Grocery Store Sales And Inventory System 1.0. There was authentication bypass in web login functionality allows an attacker to gain client privileges via SQL injection in salesinventory/login.php...

Mail.ru: Brute Force due to Weak security credentials lead access to LICENSE SYSTEM Web Server on [l.ucs.ru]

Login functionality on l.ucs.ru was not sufficiently protected against bruteforce...

Cross site request forgery (csrf)

In IgniteNet HeliOS GLinq v2.2.1 r2961, the login functionality does not contain any CSRF protection mechanisms...

PT-2020-18704

Name of the Vulnerable Software and Affected Versions IgniteNet HeliOS GLinq version 2.2.1 r2961 Description The login functionality in the affected software lacks CSRF protection mechanisms, which could potentially allow for unauthorized actions. Recommendations For version 2.2.1 r2961, consider...

CVE-2020-5783: Cross-Site Request Forgery (CSRF)

In IgniteNet HeliOS GLinq v2.2.1 r2961, the login functionality does not contain any CSRF protection mechanisms...

PT-2020-18955

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description An exploitable SQL injection issue exists in the login functionality. A specially crafted HTTP request can lead to SQL injection, allowing an attacker to send an HTTP request to trigger this issue...

CVE-2020-6141: Improper Neutralization of Special Elements used in an SQL Command

An exploitable SQL injection vulnerability exists in the login functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

OS4Ed openSIS login SQL injection vulnerability

Summary An exploitable SQL injection vulnerability exists in the login functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection. An attacker can send an HTTP request to trigger this vulnerability. Tested Versions OS4Ed openSIS 7.3 Product URLs...

CVE-2018-17388

SQL Injection exists in Twilio WEB To Fax Machine System 1.0 via the email or password parameter to logincheck.php, or the id parameter to addemail.php or editcontent.php...

Cross-Site Scripting (XSS)

moodle/moodle is vulnerable to cross-site scripting XSS. An attacker is able to inject arbitrary Javascript into another user's browsing context via a malicious dashboard script. Users with the login as other users functionality are affected by this vulnerability when they access an attacker's...

The Don 1.0.1 - 'login' SQL Injection

Exploit Title: The Don 1.0.1 - 'login' SQL Injection Dork: N/A Date: 2018-11-11 Exploit Author: Ihsan Sencan Vendor Homepage: https://thedon.sourceforge.io/ Software Link: https://netix.dl.sourceforge.net/project/thedon/thedon-1.0b.rar Version: 1.0.1 Category: Webapps Tested on:...

PT-2018-11305

Name of the Vulnerable Software and Affected Versions MISP version 2.4.92 Description A security issue allows an adversary to bypass brute-force protection in the login functionality by utilizing a PUT HTTP method instead of a POST HTTP method. This is because the protection mechanism only covers...

Authentication bypass vulnerability in Western Digital My Cloud

Abstract It was discovered that Western Digital My Cloud is affected by an authentication bypass vulnerability. By exploiting this vulnerability, an unauthenticated attacker can bypass the login functionality and gain full control of the device. Tested versions This vulnerability was successfully...

CVE-2018-8813

Open redirect vulnerability in the loginredirect parameter login functionality in WolfCMS 0.8.3.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL...

CVE-2018-8813

CVE-2018-8813 describes an open redirect vulnerability in WolfCMS 0.8.3.1, where the login[redirect] parameter in the login functionality can be exploited to redirect users to arbitrary external sites, enabling phishing scenarios. The connected documents consistently confirm the affected product/...