21 matches found
CVE-2026-104638
A security vulnerability has been detected in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The impacted element is an unknown function of the file php/sessions.php. The manipulation of the argument ID leads to improper authentication. Remote exploitatio...
CVE-2026-104638 onetwothreeneth HospitalManagementSystem sessions.php improper authentication
A security vulnerability has been detected in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The impacted element is an unknown function of the file php/sessions.php. The manipulation of the argument ID leads to improper authentication. Remote exploitatio...
CVE-2026-104638 onetwothreeneth HospitalManagementSystem sessions.php improper authentication
A security vulnerability has been detected in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The impacted element is an unknown function of the file php/sessions.php. The manipulation of the argument ID leads to improper authentication. Remote exploitatio...
EUVD-2026-91666
A security vulnerability has been detected in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The impacted element is an unknown function of the file php/sessions.php. The manipulation of the argument ID leads to improper authentication. Remote exploitatio...
CVE-2026-104638
A security vulnerability exists in the onetwothreeneth HospitalManagementSystem (up to commit 9ef91ed6007314b6473110ed699dff76d158f61d) within an unknown function in the php/sessions.php file. The root cause is the manipulation of the ID argument , which leads to improper authentication . This fl...
EUVD-2006-0829
Malware in sbrugna...
CVE-2020-29047: Deserialization of Untrusted Data
The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpresshotelbooking1 cookie in load in includes/class-wphb-sessions.php...
CVE-2018-12580: Improper Neutralization of Input During Web Page Generation
library/DBTech/Security/Action/Sessions.php in DragonByte vBSecurity 3.x through 3.3.0 for vBulletin 3 and vBulletin 4 allows self-XSS via $session'useragent' in the "Login Sessions" feature...
Sql injection
SQL injection vulnerability in the checkbanlist function in includes/sessions.php in Enano CMS 1.1.7pl1; 1.0.6pl2; and possibly other versions before 1.1.8, 1.0.6pl3, and 1.1.7pl2 allows remote attackers to execute arbitrary SQL commands via the email parameter to index.php. NOTE: some of these...
CVE-2010-4780
SQL injection in Enano CMS affects the check_banlist code path (includes/sessions.php) and can be triggered via the email parameter to index.php, allowing remote execution of arbitrary SQL. Impact is SQL-level access to the application database for affected versions (1.1.7pl1, 1.0.6pl2 and possib...
CVE-2010-4780: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the checkbanlist function in includes/sessions.php in Enano CMS 1.1.7pl1; 1.0.6pl2; and possibly other versions before 1.1.8, 1.0.6pl3, and 1.1.7pl2 allows remote attackers to execute arbitrary SQL commands via the email parameter to index.php. NOTE: some of these...
FestOS 2.2.1 Remote File Inclusion
Exploit Title: FestOs $reports header"Location:index.php"; include "includes/reportheader.php"; ? 3xplo!t : festospath/admin/reportsplacement.php?ABSOLUTEFILEPATH=Shell Code : FestOS.php requireonce$config'ABSOLUTEFILEPATH'."core/sessions.php"; 3xplo!t :...
Wheatblog (wB) Remote File inclusion ..
Hello,, Wheatblog wB Remote File inclusion .. tested on 1.1 and older versions are injected Discovered By : HACKERS PAL Copy rights : HACKERS PAL Website : http://www.soqor.net Email Address : [email protected] Remote File Inclusion file : includes/sessions.php line 2 : code:-...
Geeklog lib-sessions.php Session Cookie Handling Administrative Bypass
Binary data 3464.prm...
CVE-2006-0823
Multiple SQL injection vulnerabilities in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to inject arbitrary SQL commands via the 1 userid variable to users.php or 2 sessid variable to lib-sessions.php...
CVE-2006-0823: Undefined Security Weakness
Multiple SQL injection vulnerabilities in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to inject arbitrary SQL commands via the 1 userid variable to users.php or 2 sessid variable to lib-sessions.php...
CVE-2005-0614
sessions.php in phpBB 2.0.12 and earlier allows remote attackers to gain administrator privileges via the autologinid value in a cookie...
CVE-2005-0614
sessions.php in phpBB 2.0.12 and earlier allows remote attackers to gain administrator privileges via the autologinid value in a cookie...
phpBB 2.0.13 - user level exploit
This one goes for all phpBB versions up to 2.0.13. While applying and testing the patch for the autologin bug I found that phpBB2 doesn't reset the $userdata'userlevel' variable after a failed autologin. This is the vulvernable code in sessions.php: if $userid != ANONYMOUS $autologinkey =...