PT-2021-16829

Name of the Vulnerable Software and Affected Versions Void Aural Rec Monitor version 9.0.0.1 Description An issue was discovered in the svc-login.php file. Passwords are stored in unencrypted source-code text files, which is noted when accessing the svc-login.php file. The value is used to...

PT-2021-16830

Name of the Vulnerable Software and Affected Versions Void Aural Rec Monitor version 9.0.0.1 Description An issue was discovered in svc-login.php, allowing an unauthenticated attacker to send a crafted HTTP request and perform a blind time-based SQL Injection. The vulnerable parameter is param1...

CVE-2021-25899: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. An unauthenticated attacker can send a crafted HTTP request to perform a blind time-based SQL Injection. The vulnerable parameter is param1...

Void Aural Rec Monitor SQL注入漏洞

Void Aural Rec Monitor is an application from the Spanish company Void. Aural Rec Monitor version 9.0.0.1 suffers from a SQL injection vulnerability, which originates in svc-login.php, where an unauthenticated attacker sends a crafted HTTP request to perform a blind time-based SQL injection...

CVE-2021-25898: Cleartext Storage of Sensitive Information

An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Passwords are stored in unencrypted source-code text files. This was noted when accessing the svc-login.php file. The value is used to authenticate a high-privileged user upon authenticating with the server...

CVE-2021-24228

The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form wp-login.php is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of...

CVE-2021-24228: Improper Neutralization of Input During Web Page Generation

The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form wp-login.php is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of...

Stop Spammers < 2021.9 - Reflected Cross-Site Scripting (XSS)

The plugin did not escape user input when blocking requests such as matching a spam word, outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue. From an IP not in the Allow List...

eChat 1.0 SQL Injection Vulnerability

Exploit Title: eChat | Time-Based Blind SQL Injection Exploit Author: email protected Vendor Homepage: https://www.sourcecodester.com/php/10498/echat-simple-chat-system-app-using-phpmysql.html Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/echat.zip Version:...

eChat 1.0 SQL Injection

Exploit Title: eChat | Time-Based Blind SQL Injection Exploit Author: [email protected] Date: 2021-02-21 Vendor Homepage: https://www.sourcecodester.com/php/10498/echat-simple-chat-system-app-using-phpmysql.html Software Link:...

CVE-2020-35952

CVE-2020-35952 affects PHPFusion (PHP-Fusion) Andromeda 9.x before 2020-12-30. The issue is that login.php generates error messages that differentiate between an incorrect username and an incorrect password, rather than a single generic message, which could enable user enumeration. The connected ...

CVE-2020-35952

login.php in PHPFusion aka PHP-Fusion Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password i.e., not a single "Incorrect username or password" message in both cases, which might allow enumeration...

CVE-2020-35952

login.php in PHPFusion aka PHP-Fusion Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password i.e., not a single "Incorrect username or password" message in both cases, which might allow enumeration...

CVE-2020-35952: Undefined Security Weakness

login.php in PHPFusion aka PHP-Fusion Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password i.e., not a single "Incorrect username or password" message in both cases, which might allow enumeration...

PT-2021-11884

Name of the Vulnerable Software and Affected Versions: PHPFusion aka PHP-Fusion Andromeda versions 9.x before 2020-12-30 Description: The issue arises from the login.php file generating distinct error messages for incorrect usernames and passwords, rather than a unified message. This distinction...

CVE-2021-3002

Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter...

CVE-2021-3002

Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter...

CVE-2021-3002

Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter...

CVE-2021-3002: Improper Neutralization of Input During Web Page Generation

Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter...

CVE-2020-20285: Improper Neutralization of Input During Web Page Generation

There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php...