CVE-2021-38725

Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php...

CVE-2021-38840

SQL Injection can occur in Simple Water Refilling Station Management System 1.0 via the waterrefilling/classes/Login.php username parameter...

CVE-2021-38840

SQL Injection can occur in Simple Water Refilling Station Management System 1.0 via the waterrefilling/classes/Login.php username parameter...

eLearning V2(by: oretnom23) is vulnerable from remote SQL-Injection-Bypass-Authentication

Description: The eLearning V2by: oretnom23 is vulnerable from remote SQL-Injection-Bypass-Authentication in 3 accounts of the system admin, Faculty & Student in app /elearning/classes/Login.php. remote SQL-Injection-Bypass-Authentication: . The parameter username, facultyid, and studentid from th...

Online Leave Management System 1.0 SQL Injection

Exploit Title: OLMS - PHP by: oretnom23 v1.0 SQL-Injection-Bypass-Authentication in /leavesystem/classes/Login.php. Author: nu11secur1ty Testing and Debugging: nu11secur1ty Date: 08.31.2021 Vendor: https://www.sourcecodester.com/php/14910/online-leave-management-system-php-free-source-code.html...

SES-by-oretnom23 -v1.0-SQL-Injection-bypass-Login

The SES-byoretnom23 -v1.0 is vulnerable in the application /elearning/classes/Login.php which is called from /elearning/dist/js/script.js app. The parameter username from the login form is not protected correctly and there is no security and escaping from malicious payloads. When the user is...

EyouCMS Cross-site Request Forgery Vulnerability

EyouCMS is an open source content management system CMS based on ThinkPHP.EyouCMS suffers from a cross-site request forgery vulnerability, which stems from a cross-site request forgery CSRF vulnerability in EyouCMS 1.3.6. An attacker could use the vulnerability to execute js code by adding an htm...

CVE-2020-20642

Cross Site Request Forgery CSRF vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn...

Cross site scripting

Cross Site Scripting XSS vulnerability in gnuboard5 =v5.3.2.8 via the url parameter to bbs/login.php...

MetInfo Cross-Site Scripting Vulnerability (CNVD-2021-49143)

MetInfo is a Content Management System CMS developed using PHP and Mysql. A cross-site scripting vulnerability exists in MetInfo. The vulnerability can be exploited to conduct cross-site scripting attacks via the gourl parameter in login.php...

CVE-2020-22165

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...

Cross site scripting

Cross Site Scripting XSS vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php...

CVE-2020-21517

Cross Site Scripting XSS vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php...

CVE-2020-21517

MetInfo 7.0.0 is affected by a Cross‑Site Scripting (XSS) vulnerability exploitable via the gourl parameter in login.php. The issue is identified as CVE-2020-21517. Provided sources consistently describe the vulnerable entry as MetInfo’s login flow accepting gourl input that can be manipulated to...

CVE-2021-31738

Adiscon LogAnalyzer 4.1.10 and 4.1.11 allow login.php XSS...

Adiscon LogAnalyzer 跨站脚本漏洞

Adiscon LogAnalyzer is a set of web front-end tools for system logs and other network event data. The tool provides log browsing, search and basic analysis, and graphical display. A security vulnerability exists in Adiscon LogAnalyzer 4.1.10 and 4.1.11 that allows login.php to execute XSS...

PHP Timeclock 1.04 SQL Injection

Exploit Title: PHP Timeclock 1.04 - Time and Boolean Based Blind SQL Injection Date: 03.05.2021 Exploit Author: Tyler Butler Vendor Homepage: http://timeclock.sourceforge.net Software Link: https://sourceforge.net/projects/timeclock/files/PHP%20Timeclock/PHP%20Timeclock%201.04/ Version: 1.04 Test...

CVE-2021-25898

An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Passwords are stored in unencrypted source-code text files. This was noted when accessing the svc-login.php file. The value is used to authenticate a high-privileged user upon authenticating with the server...

CVE-2021-25898

An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Passwords are stored in unencrypted source-code text files. This was noted when accessing the svc-login.php file. The value is used to authenticate a high-privileged user upon authenticating with the server...

CVE-2021-25899

Void Aural Rec Monitor 9.0.0.1 contains a SQL injection in svc-login.php (param1) exploitable via blind time-based requests. An unauthenticated attacker can trigger the vulnerability to potentially read data, modify data, and perform unauthorized administrative actions. No exploit details are pro...