1451 matches found
CVE-2006-0856
The CVE-2006-0856 entry describes a SQL injection in login.php of Scriptme SmE GB Host 1.21 that lets remote attackers execute arbitrary SQL and bypass authentication via the Username parameter. Affected software is Scriptme SmE GB Host 1.21; the vulnerability arises from improper handling of the...
Sql injection
Multiple SQL injection vulnerabilities in Skate Board 0.9 allow remote attackers to execute arbitrary SQL commands via the 1 usern parameter in a sendpass.php, and the 2 usern and 3 passwd parameters and 4 sfcookie cookie in b login.php and c logged.php...
CVE-2006-0809
Multiple SQL injection vulnerabilities in Skate Board 0.9 allow remote attackers to execute arbitrary SQL commands via the 1 usern parameter in a sendpass.php, and the 2 usern and 3 passwd parameters and 4 sfcookie cookie in b login.php and c logged.php...
CVE-2006-0685
The checklogin function in login.php in Virtual Hosting Control System VHCS 2.4.7.1 and earlier does not exit when authentication fails, which allows remote attackers to gain unauthorized access...
Sql injection
SQL injection vulnerability in login.php in aoblogger 2.3 allows remote attackers to execute arbitrary SQL commands via the username parameter...
CVE-2006-0311
CVE-2006-0311 is an SQL injection in aoblogger 2.3, exposed via login.php and the username parameter. The vulnerability allows remote attackers to execute arbitrary SQL commands. Reported impact aligns with CVSS base metrics (7.5: High; network vector, low complexity, no authentication). Affected...
CVE-2006-0182
CVE-2006-0182 affects ACal Calendar Project 2.2.5. The vulnerability in login.php allows remote bypass of authentication by setting the ACalAuthenticate cookie to the literal value “inside,” enabling unauthorized access. Relatedly, CVE-2006-0183 in edit.php permits authenticated users to execute ...
CVE-2006-0182
login.php in ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside"...
Authentication flaw
login.php in ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside"...
CVE-2006-0135
SQL injection vulnerability in login.php in TheWebForum twf 1.2.1 allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the username parameter aka the u variable...
CVE-2006-0067
VEGO Links Builder 2.00 and earlier contains a SQL injection vulnerability in login.php via the username parameter. Multiple connected advisories summarize that remote attackers could cause arbitrary SQL commands to be executed on the affected system. The CVE entry notes the vulnerability but doe...
CVE-2005-4136
CVE-2005-4136 describes a Cross-site Scripting (XSS) vulnerability in DRZES HMS 3.2, specifically in login.php where the customerEmailAddress parameter can be exploited to inject arbitrary web script/HTML. The issue affects the login process and can be triggered remotely, with a NVD base score of...
PHPX 3.5.x - Admin login.php SQL Injection
PHPX 3.5.x - Admin login.php SQL Injection source: https://www.securityfocus.com/bid/15680/info PHPX is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation coul...
CVE-2005-3789
Multiple directory traversal vulnerabilities in phpwcms 1.2.5 allow remote attackers to read arbitrary files via a .. dot dot in the 1 formlang parameter in login.php and 2 the imgdir parameter in randomimage.php...
CVE-2005-3418
Multiple cross-site scripting XSS vulnerabilities in phpBB 2.0.17 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 errormsg parameter to usercpregister.php, 2 forwardpage parameter to login.php, and 3 listcat parameter to search.php, which are not initialized as...
CVE-2005-3418
Multiple cross-site scripting XSS vulnerabilities in phpBB 2.0.17 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 errormsg parameter to usercpregister.php, 2 forwardpage parameter to login.php, and 3 listcat parameter to search.php, which are not initialized as...
CVE-2004-2509
Infopop UBB.Threads exposes XSS in multiple pages. Affected versions include 6.2.3 and 6.5, with vulnerable scripts calendar.php, login.php, and online.php. The underlying issue is cross-site scripting via the Cat parameter, enabling remote attackers to inject arbitrary script/HTML into a user’s ...
CVE-2005-3153
login.php in myBloggie 2.1.3 beta and earlier allows remote attackers to bypass a whitelist regular expression and conduct SQL injection attacks via a username parameter with SQL after a null character, which causes the whitelist check to succeed but injects the SQL into a query string, a differe...
Digital Scribe login.php SQL Injection
The remote web server hosts Digital Scribe, a student-teacher set of scripts written in PHP. The version of Digital Scribe installed on the remote host is prone to a SQL injection attack through the 'login.php' script. A malicious user may be able to exploit this issue to manipulate database...