OpenRapid RapidCMS security vulnerability

OpenRapid RapidCMS is OpenRapid open source a fast and easy to use CMS system. A security vulnerability exists in OpenRapid RapidCMS v1.3.1, which originates from a SQL injection vulnerability via the username parameter on /resource/runlogin.php...

CVE-2024-44838

The open-source RapidCMS content management system, specifically version v1.3.1 , is susceptible to a SQL injection vulnerability. The root cause is the improper neutralization of special elements in the username parameter located at the /resource/runlogin.php endpoint. Successful exploitation co...

CVE-2024-44727

Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php...

CVE-2024-44727

Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php...

python-django: Username enumeration through timing difference for users with unusable passwords

A vulnerability was found in Python-Django in the django.contrib.auth.backends.ModelBackend.authenticate method. This flaw allows remote attackers to enumerate users via a timing attack involving login requests for users with unusable passwords...

CVE-2024-8471

Cross-Site Scripting XSS vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through JOBID and USERNAME parameters in /jobportal/process.php...

CVE-2024-8471

CVE-2024-8471 concerns a Cross-Site Scripting (XSS) vulnerability in a Job Portal web application. The vulnerability arises from insufficient handling/encryption of user-controlled input in the /jobportal/process.php endpoint, with JOBID and USERNAME parameters being implicated. Exploitation coul...

CVE-2024-44727

Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php...

CVE-2024-44727

Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php...

PT-2024-31224 · Unknown · Sourcecodehero Event Management System

Name of the Vulnerable Software and Affected Versions: Sourcecodehero Event Management System version 1.0 Description: The issue is related to a SQL Injection vulnerability via the parameter username in the "/event/admin/login.php" endpoint. This allows attackers to remotely compromise databases...

PT-2024-31692 · Identity Automation · Rapididentity Lts +1

Name of the Vulnerable Software and Affected Versions: RapidIdentity LTS versions 2023.0.2 and earlier RapidIdentity Cloud versions 2024.08.0 and earlier Description: The issue allows a remote attacker to cause a denial of service via the username parameters by improperly restricting excessive...

Sourcecodehero Event Management System security vulnerabilities

Sourcecodehero Event Management System is an open source event management system from Sourcecodehero. A security vulnerability exists in Sourcecodehero Event Management System version 1.0, which is caused by SQL injection via the parameter "username" in /event/admin/login.php...

PHPGurukul Job Portal Cross-site Scripting Vulnerability

PHPGurukul Job Portal is a PHP-based job search website system from PHPGurukul. A cross-site scripting vulnerability exists in PHPGurukul Job Portal version 1.0, which originates from the JOBID and USERNAME parameters in /jobportal/process.php...

CVE-2024-44727

Sourcecodehero Event Management System 1.0 is vulnerable to an SQL Injection via the username parameter in /event/admin/login.php. Documented across multiple feeds; no patch/version fix details are provided in the supplied materials. Exploitation details, impact, and mitigations beyond the generi...

CVE-2024-45589: Improper Restriction of Excessive Authentication Attempts

RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote attacker to cause a denial of service via the username parameters...

CVE-2024-44727: Improper Neutralization of Special Elements used in an SQL Command

Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php...

CVE-2024-8471: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through JOBID and USERNAME parameters in /jobportal/process.php...

CVE-2024-45589

RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote attacker to cause a denial of service via the username parameters...

Timing-Based Username Enumeration Vulnerability in Fides Webserver Authentication

A timing-based username enumeration vulnerability has been identified in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. The discrepancy ...

CVE-2024-45052

Fides is an open-source privacy engineering platform. Prior to version 2.44.0, a timing-based username enumeration vulnerability exists in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it...