Sql injection

SQL injection vulnerability in login.php in Pedro Santana Codice CMS allows remote attackers to execute arbitrary SQL commands via the username field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-0651

SQL injection vulnerability in login.php in Pedro Santana Codice CMS allows remote attackers to execute arbitrary SQL commands via the username field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-0650

SQL injection vulnerability in login.php in Simple OS CMS 0.1c beta allows remote attackers to execute arbitrary SQL commands via the username field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-0650

Vulnerability summary (CVE-2008-0650): In Simple OS CMS 0.1c beta, the login.php username field is susceptible to SQL injection, enabling remote attackers to execute arbitrary SQL commands. This affects the login process and can impact confidentiality, integrity, and availability (as per NVD metr...

CVE-2008-0651

The CVE-2008-0651 entry refers to a SQL injection vulnerability in login.php of Codice CMS, where the username field allows remote attackers to execute arbitrary SQL commands. The provided documents consistently describe this same issue, including the root cause (injection in login handling) and ...

WordPress MU 1.3.2 - active_plugins option Code Execution

WordPress MU 1.3.2 - activeplugins option Code Execution Website : http://www.buayacorp.com/ Advisory: http://www.buayacorp.com/files/wordpress/wordpress-mu-options-overwrite.html This exploit uses activeplugins option to execute arbitrary PHP / includeonce './class-snoopy.php'; // Fix Snoopy cla...

Codice CMS - login.php SQL Injection

Codice CMS - login.php SQL Injection source: https://www.securityfocus.com/bid/27592/info Codice CMS is prone to an SQL-injection vulnerability because it fails to adequately sanitize user-supplied data. A successful exploit may allow an attacker to compromise the application, access or modify...

CVE-2008-0286

CVE-2008-0286 : A SQL injection vulnerability exists in the admin/login.php of Article Dashboard, allowing remote attackers to execute arbitrary SQL commands via the (1) user or (2) password fields. The issue is publicly documented in NVD and CVE records, with no explicit remediation details prov...

CVE-2007-3694

CVE-2007-3694 is an XSS vulnerability in Miro Project Broadcast Machine 0.9.9.9, exploitable via the login.php username parameter to inject arbitrary script/HTML. CVSS from NVD: 4.3 (Medium). Affected component: login form handling in login.php; root cause: reflected/XSS via username input. Impac...

Miro Broadcast Machine 0.9.9 - 'login.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/26407/info Miro Broadcast Machine is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue allows attackers to execute arbitrary HTML or script code in a user's browser session in...

Cross site scripting

Cross-site scripting XSS vulnerability in phpPgAdmin 3.5 to 4.1.1, and possibly 4.1.2, allows remote attackers to inject arbitrary web script or HTML via certain input available in PHPSELF in 1 redirect.php, possibly related to 2 login.php, different vectors than CVE-2007-2865...

CVE-2007-5728

Cross-site scripting XSS vulnerability in phpPgAdmin 3.5 to 4.1.1, and possibly 4.1.2, allows remote attackers to inject arbitrary web script or HTML via certain input available in PHPSELF in 1 redirect.php, possibly related to 2 login.php, different vectors than CVE-2007-2865...

CVE-2003-1466

CVE-2003-1466 affects Phorum 3.4–3.4.2. Unspecified vulnerability allows remote attackers to use Phorum as a proxy to other sites via (1) register.php or (2) login.php, enabling potential abuse of the application as a gateway to external hosts. The provided documents do not include concrete explo...

CVE-2003-1401

login.php in php-Board 1.0 stores plaintext passwords in $username.txt with insufficient access control under the web document root, which allows remote attackers to obtain sensitive information via a direct request...

CVE-2007-5579

Pligg CMS 9.5 is affected by CVE-2007-5579 through login.php, where a guessable confirmation code enables password reset by an attacker knowing a username. The root cause is a predictable confirmationcode parameter used during forgotten-password flow, allowing an unauthorized password reset with ...

Default credentials

Stride 1.0 has a default administrator username of "scott" with the password "running", which allows remote attackers to obtain administrative access through login.php...

FrontAccounting 1.13 Remote File Inclusion Vulnerabilities

Exploit for unknown platform in category web applications ========================================================== FrontAccounting 1.13 Remote File Inclusion Vulnerabilities ========================================================== ?????????? ??????????????? ???????????????????...

Sql injection

Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via 1 the pseudo parameter to login.php, 2 the id parameter to index.php in a carnet editer action in the MemberSpace espacemembre module, or 3 the typenav parameter to index.php in a...

CVE-2007-4956

Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via 1 the pseudo parameter to login.php, 2 the id parameter to index.php in a carnet editer action in the MemberSpace espacemembre module, or 3 the typenav parameter to index.php in a...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in phpFFL 1.24 allow remote attackers to execute arbitrary PHP code via a URL in the PHPFFLFILEROOT parameter to 1 admin.php, 2 custompages.php, 3 draft.php, 4 faq.php, 5 leagues.php, 6 livedraft.php, 7 login.php, 8 myteam.php, 9 profile.php, 10...