CVE-2019-6243

CVE-2019-6243 affects Frog CMS 0.9.5 with a cross-site scripting (XSS) vulnerability exposed via the forgot password page (the /admin/?/login/forgot URI). The issue is confirmed across multiple sources (NVD entry and CNVD/CVEs references) and is limited to input handling on the forgot-password fl...

CVE-2019-6243

Frog CMS 0.9.5 allows XSS via the forgot password page aka the /admin/?/login/forgot URI...

TOTOLINK A3002RU cross-site scripting vulnerability (CNVD-2018-24105)

TOTOLINK A3002RU is a wireless router product from Gion Electronics TOTOLINK. A cross-site scripting vulnerability exists in the password.htm page in TOTOLINK A3002RU version 1.0.8. A remote attacker can exploit this vulnerability to execute arbitrary JavaScript code with the help of a username...

TOTOLINK A3002RU Password Disclosure Vulnerability

The TOTOLINK A3002RU is an AC1200 wireless dual-band Gigabit router. A password disclosure vulnerability exists in password.htm in TOTOLINK A3002RU version 1.0.8, which can be exploited to obtain an administrator user's password in plaintext by sending a GET request to password.htm...

bcgdesignondemand.com XSS vulnerability

Open Bug Bounty ID: OBB-664762 Description| Value ---|--- Affected Website:| bcgdesignondemand.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-1000549

Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker could perform a brute force attack to obtain valid usernames and email addresses.. This attack appear to be exploitable via HTTP Request...

calvert.com XSS vulnerability

Open Bug Bounty ID: OBB-584065 Description| Value ---|--- Affected Website:| calvert.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

fixya.com XSS vulnerability

Open Bug Bounty ID: OBB-575366 Description| Value ---|--- Affected Website:| fixya.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

the-west.de XSS vulnerability

Vulnerable URL: https://www.the-west.de/index.php?page=changepassword=requestpassword Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 269919 VIP website status:| No Coordinated Disclosure Timeline: Description|...

liga-manager.de XSS vulnerability

Vulnerable URL: https://www.liga-manager.de/password Details: Description| Value ---|--- Patched:| No Latest check for patch:| 06.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 416644 VIP website status:| No Coordinated Disclosure Timeline: Description| Val...

Mail.ru: Clickjacking Full account takeover and editing the personal information at [account.my.com]

Hi, while i was testing i found that my.com is vulnerable to clickjacking so i checked if the settings page is vulnerable or not and it was vulnerable so now this has a risk!, the attacker could make an exploit code at the changing password page to takeover the victim account, and the same with t...

PT-2017-19014 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.1.3-15152 Description: The issue allows remote attackers to enumerate valid usernames via unspecified vectors due to an information exposure vulnerability in forget passwd.cgi...

moneymappress.com XSS vulnerability

Vulnerable URL: http://www.moneymappress.com/reset-password/ Details: Description| Value ---|--- Patched:| Yes, at 30.01.2016 Latest check for patch:| 30.01.2016 23:41 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 18766 Google Pagerank| 3 VIP website status:|...

legacy.cpbi-icra.ca XSS vulnerability

Vulnerable URL: http://legacy.cpbi-icra.ca/fr/forgotpassword.ch2 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google Pagerank| 0 VIP website status:| No...

idxco.com XSS vulnerability

Vulnerable URL: http://www.idxco.com/mgmt/forgottenPassword.php?message=%22%3E%3Csvg/onload=alert%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 30.11.2015 Latest check for patch:| 30.11.2015 01:27 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

WSO2 Identity Server /carbon/user/change-passwd.jsp Cross-Site Scripting Vulnerability

WSO2 Identity Server is an open source identity services , support for Information Cards, OpenID and XACML. WSO2 Identity Server /carbon/user/change-passwd.jsp cross-site scripting vulnerability allows remote attackers to exploit the vulnerability by injecting malicious script or HTML code, which...

Authentication flaw

Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to bypass authentication and obtain administrative access by visiting the change-password page...

PT-2012-5160 · Pbboard · Pbboard

Name of the Vulnerable Software and Affected Versions: PBBoard version 2.1.4 Description: The issue allows remote attackers to change the password of arbitrary user accounts. This is achieved by exploiting the new password page, specifically through the member id and new password parameters to th...

CVE-2012-0535

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6 and 12.1.3 allows remote attackers to affect confidentiality via unknown vectors related to Change Password Page...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6 and 12.1.3 allows remote attackers to affect confidentiality via unknown vectors related to Change Password Page...