PT-2019-14002

Name of the Vulnerable Software and Affected Versions Humanica Humatrix versions 1.0.0.203 through 1.0.0.681 Description The issue allows an unauthenticated attacker to access all candidates' files in the photo folder on the website. This can be achieved by specifying a user id parameter and file...

PT-2019-5199

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.33.1 Description The issue is related to the Special:Redirect function in MediaWiki, which allows information disclosure of suppressed usernames via a User ID Lookup. This is due to a lack of protection for intern...

CVE-2019-13143

An HTTP parameter pollution issue was discovered on Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 2.3. With the user ID, user name, and the lock's MAC address, anyone can unbind the existing owner of the lock, and bind themselves instead. This leads to complete takeover of the...

PT-2019-11675 · WordPress · Ultimate Member

Name of the Vulnerable Software and Affected Versions: Ultimate Member plugin version 2.39 Description: An issue in the Ultimate Member plugin for WordPress allows unauthorized modification of user profiles and cover pictures. Once connected, an attacker can modify the profile and cover picture o...

CVE-2019-10270

An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible due to lack of verification and correlation between the reset password key sent by mail and the userid parameter to reset the password of another user. One only needs to know the...

CVE-2019-10270

An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible due to lack of verification and correlation between the reset password key sent by mail and the userid parameter to reset the password of another user. One only needs to know the...

PT-2019-11674 · WordPress · Ultimate Member

Name of the Vulnerable Software and Affected Versions: Ultimate Member plugin version 2.39 for WordPress Description: An issue was discovered in the password reset functionality, allowing an attacker to reset the password of another user without proper verification. This is possible because the...

CVE-2019-12902

Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore the deleted user's data...

CVE-2019-12902: Incomplete Cleanup

Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore the deleted user's data...

CVE-2019-12372

Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form...

Sql injection

Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form...

CVE-2019-12372

Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form...

CVE-2019-12372

Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form...

Petraware pTransformer ADC < 2.1.7.22827 - Login Bypass Vulnerability

Exploit Title: Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form. Date: 28-05-2019 Exploit Author: Faudhzan Rahman Website: https://faudhzanrahman.blogspot.com/ Vendor Homepage: http://www.petraware.com Version: 2.0 CVE : CVE-2019-12372...

Petraware pTransformer ADC SQL Injection

Exploit Title: Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form. Date: 28-05-2019 Exploit Author: Faudhzan Rahman Website: https://faudhzanrahman.blogspot.com/ Vendor Homepage: http://www.petraware.com Version: 2.0 CVE : CVE-2019-12372...

PT-2019-12766

Name of the Vulnerable Software and Affected Versions Petraware pTransformer ADC versions prior to 2.1.7.22827 Description The issue allows SQL Injection via the User ID parameter to the "login form" API endpoint. This could potentially be exploited to extract or modify sensitive data...

CVE-2019-12372: Improper Neutralization of Special Elements used in an SQL Command

Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form...

Petraware pTransformer ADC < 2.1.7.22827 - Login Bypass

Exploit Title: Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form. Date: 28-05-2019 Exploit Author: Faudhzan Rahman Website: https://faudhzanrahman.blogspot.com/ Vendor Homepage: http://www.petraware.com Version: 2.0 CVE : CVE-2019-12372...

CVE-2014-9918

An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the userid parameter to signup.php...

PT-2019-7156

Name of the Vulnerable Software and Affected Versions Bilboplanet version 2.0 Description A stored XSS issue exists due to the user id parameter in the "signup.php" endpoint. Recommendations For Bilboplanet version 2.0, consider restricting access to the vulnerable signup.php endpoint until a pat...