PT-2020-9285

Name of the Vulnerable Software and Affected Versions ONAP Portal versions through Dublin Description An issue was detected in the ONAP Portal, where an attacker can execute a padding oracle attack using the ONAPPORTAL/processSingleSignOn UserId field to decrypt arbitrary information encrypted wi...

CVE-2019-12121: Inadequate Encryption Strength

An issue was detected in ONAP Portal through Dublin. By executing a padding oracle attack using the ONAPPORTAL/processSingleSignOn UserId field, an attacker is able to decrypt arbitrary information encrypted with the same symmetric key as UserId. All Portal setups are affected...

PT-2020-20174

Name of the Vulnerable Software and Affected Versions Kronos Web Time and Attendance webTA versions 3.8.x through 3.x before 4.0 Description The issue allows an attacker with specific privileges to gain unauthorized administrative privileges within the application. This is achieved through the...

CVE-2020-8494: Undefined Security Weakness

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the empid, userid, pw...

Semrush: IDOR in semrush academy

INTRODUCTION I used two accounts to search for this vulnerability: - id: 5410425 email: ████[email protected] - id: 5407773 email: ████@anosimple.com IP used: ███ Endpoint URL: https://www.semrush.com/academy/courses/userEnroll EXPLOITATION Description of Security Issue: When a user clicks on the...

PT-2019-13506

Name of the Vulnerable Software and Affected Versions Ovidentia version 8.4.3 Description The issue concerns a problem with index.php in Ovidentia, where there is a possibility of XSS via several specific parameters. The affected parameters include tg=groups, tg=maildoms&idx=create&userid=0&bgrp=...

CVE-2018-14027

Digisol Wireless Wifi Home Router HR-3300 allows XSS via the userid or password parameter to the admin login page...

PT-2019-9019

Name of the Vulnerable Software and Affected Versions Digisol Wireless Wifi Home Router HR-3300 Description The issue allows for XSS via the userid or password parameter to the "admin login page" API endpoint. Recommendations For Digisol Wireless Wifi Home Router HR-3300, avoid using the userid o...

CVE-2018-14027: Improper Neutralization of Input During Web Page Generation

Digisol Wireless Wifi Home Router HR-3300 allows XSS via the userid or password parameter to the admin login page...

CVE-2019-7316

An issue was discovered in CSS-TRICKS Chat2 through 2015-05-05. The userid parameter in jumpin.php has a SQL injection vulnerability...

CVE-2019-7316

An issue was discovered in CSS-TRICKS Chat2 through 2015-05-05. The userid parameter in jumpin.php has a SQL injection vulnerability...

PT-2019-18525

Name of the Vulnerable Software and Affected Versions CSS-TRICKS Chat2 versions through 2015-05-05 Description An issue was discovered in the software, where the userid parameter in the "jumpin.php" endpoint has a SQL injection issue. Recommendations For CSS-TRICKS Chat2 versions through...

CVE-2019-7316: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in CSS-TRICKS Chat2 through 2015-05-05. The userid parameter in jumpin.php has a SQL injection vulnerability...

Sql injection

SQL Injection exists in the Questions 1.4.3 component for Joomla! via the term, userid, users, or groups parameter...

CVE-2018-17377: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in the Questions 1.4.3 component for Joomla! via the term, userid, users, or groups parameter...

PT-2018-14000

Name of the Vulnerable Software and Affected Versions Joomla! version 1.4.3 Description A SQL Injection issue exists in the Questions component of Joomla! via the term, userid, users, or groups parameter. Recommendations For Joomla! version 1.4.3, consider restricting access to the Questions...

Telus Actiontec T2200H Command Injection Vulnerability

The Telus Actiontec T2200H is a modem device from Telus USA. A command injection vulnerability exists in the fileshare.cmd file in the Telus Actiontec T2200H using firmware version T2200H-31.128L.03. An attacker can exploit this vulnerability to inject operating system commands with the help of...

Twitter-Clone 1 - userid SQL Injection

Twitter-Clone 1 - userid SQL Injection Exploit Title: Twitter-Clone 1 - 'userid' SQL Injection Date: 2018-08-21 Exploit Author: L0RD Vendor Homepage: https://github.com/Fyffe/PHP-Twitter-Clone/ Version: 1 CVE: N/A Tested on: Win 10 POC : SQLi vulnerable files : follow.php , index.php vulnerable...

CVE-2018-15145

Multiple SQL injection vulnerabilities in portal/addediteventuser.php in versions of OpenEMR before 5.0.1.4 allow a remote attacker to execute arbitrary SQL commands via the 1 eid, 2 userid, or 3 pid parameter...

CVE-2018-15145: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in portal/addediteventuser.php in versions of OpenEMR before 5.0.1.4 allow a remote attacker to execute arbitrary SQL commands via the 1 eid, 2 userid, or 3 pid parameter...