803 matches found
PT-2023-30995 · Eyoucms · Eyoucms
Name of the Vulnerable Software and Affected Versions: EyouCMS version 1.6.4-UTF8-SP1 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu Name field at...
Authentication Bypass
LibreNMS is vulnerable to Authentication Bypass. The vulnerability is due to improper rate limiting checks on login mechanisms using the GET method in the /?username=admin=password= endpoint. This can be exploited by an attacker to perform a brute force attack at the login endpoint, resulting in...
PT-2023-21912 · Unknown · I Recommend This
Name of the Vulnerable Software and Affected Versions: I Recommend This versions 3.9.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user int...
Sangfor Next-Gen Application Firewall Operating System Command Injection Vulnerability
Sangfor Next-Gen Application Firewall Sangfor NGAF is an application firewall from China-based Sangfor. A security vulnerability exists in Sangfor Next-Gen Application Firewall NGAF version 8.0.17, which originates from an operating system command injection vulnerability. The vulnerability can be...
PT-2023-28816 · Unknown · Tianchoy/Blog
Name of the Vulnerable Software and Affected Versions: Tianchoy Blog version 1.8.8 Description: A SQL Injection issue allows a remote attacker to obtain sensitive information via the id parameter in the "login.php" API endpoint. Recommendations: For Tianchoy Blog version 1.8.8, avoid using the id...
Exploit for Type Confusion in Macs_Cms_Project Macs_Cms
CVE-2023-43154 - Macs Framework v1.1.4f CMS Type Confusion Vul...
PT-2023-29131 · Ruijie · Ruijie Rg-Ew1200G
Name of the Vulnerable Software and Affected Versions: Ruijie RG-EW1200G version 07161417 r483 Description: A critical issue affects some unknown functionality of the /api/sys/login API endpoint, leading to improper authentication. The attack can be launched remotely. The exploit has been disclos...
PT-2023-26103 · Unknown · Online Shopping Portal Project
Name of the Vulnerable Software and Affected Versions: Online Shopping Portal Project version 3.1 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the Email parameter at the "/shopping/login.php" API endpoint. Recommendations: For Online...
PT-2023-22365 · Wildix · Wildix Wsg24Poe
Name of the Vulnerable Software and Affected Versions: Wildix WSG24POE version 103SP7D190822 Description: An issue was discovered in the "/cgi-bin/login rj.cgi" API endpoint, allowing attackers to bypass authentication. Recommendations: For Wildix WSG24POE version 103SP7D190822, consider disablin...
CVE-2023-34243
TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server TGS, an attacker could discover their username by brute-forcing the login endpoint with an invalid password. When a valid Windows logon was found, a distinct respon...
Code injection
TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server TGS, an attacker could discover their username by brute-forcing the login endpoint with an invalid password. When a valid Windows logon was found, a distinct respon...
PT-2023-24767 · Tgstation · Tgstation
Name of the Vulnerable Software and Affected Versions: TGstation versions prior to 5.12.5 Description: TGstation is a toolset to manage production BYOND servers. In affected versions, if a Windows user was registered in tgstation-server TGS, an attacker could discover their username by...
PT-2023-23448 · Sourcecodester · Sourcecodester Employee/Visitor Gate Pass Logging System
Name of the Vulnerable Software and Affected Versions: SourceCodester Employee and Visitor Gate Pass Logging System version 1.0 Description: The issue is related to SQL Injection via the /employee gatepass/classes/Login.php endpoint. This allows for potential exploitation. Recommendations: For...
PT-2023-23408 · Wso2 · Wso2 Api Manager
Name of the Vulnerable Software and Affected Versions: WSO2 API Manager versions prior to 4.2.0 Description: A reflected cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter in the...
CVE-2023-27742
IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login...
PT-2023-21313 · Unknown · Idurar Erp/Crm
Name of the Vulnerable Software and Affected Versions: IDURAR ERP/CRM version 1 Description: The issue is related to a SQL injection vulnerability. It affects the /api/login component. Recommendations: For IDURAR ERP/CRM version 1, consider restricting access to the /api/login endpoint until a...
PT-2023-19970 · Caton · Caton Ctp Relay Server
Name of the Vulnerable Software and Affected Versions: Caton CTP Relay Server version 1.2.9 Description: A critical issue has been found in the API component of the affected software, specifically in the /server/api/v1/login endpoint. The manipulation of the username and password arguments leads ...
PT-2023-17720 · Sourcecodester · Sourcecodester Vehicle Service Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Vehicle Service Management System version 1.0 Description: A critical issue was found in the system, affecting the /classes/Login.php file. The manipulation of the username argument leads to SQL injection. This issue can be...
PT-2023-22334 · Unknown · Purchase Order Management
Name of the Vulnerable Software and Affected Versions: Purchase Order Management version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the password parameter at the "/purchase order/admin/login.php" API endpoint. Recommendations: F...