YubiKey Side-Channel Attack

There is a side-channel attack against YubiKey access tokens that allows someone to clone a device. Its a complicated attack, requiring the victims username and password, and physical access to their YubiKey--as well as some technical expertise and equipment. Still, nice piece of security analysi...

Username Enumeration Attack

ethycafides is vulnerable to Username Enumeration Attack. The vulnerability is due to discrepancies in response times between valid and invalid usernames, which allow attackers to infer valid usernames based on the timing of server responses...

CVE-2024-44838

RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the username parameter at /resource/runlogin.php...

CVE-2024-44838

RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the username parameter at /resource/runlogin.php...

PT-2024-31273

Name of the Vulnerable Software and Affected Versions RapidCMS version 1.3.1 Description A SQL injection issue was found in the username parameter at the "/resource/runlogin.php" API endpoint. This allows for potential exploitation. No information is provided about the estimated number of affecte...

CVE-2024-44838

RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the username parameter at /resource/runlogin.php...

OpenRapid RapidCMS security vulnerability

OpenRapid RapidCMS is OpenRapid open source a fast and easy to use CMS system. A security vulnerability exists in OpenRapid RapidCMS v1.3.1, which originates from a SQL injection vulnerability via the username parameter on /resource/runlogin.php...

CVE-2024-44838

The open-source RapidCMS content management system, specifically version v1.3.1 , is susceptible to a SQL injection vulnerability. The root cause is the improper neutralization of special elements in the username parameter located at the /resource/runlogin.php endpoint. Successful exploitation co...

CVE-2024-44838: Improper Neutralization of Special Elements used in an SQL Command

RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the username parameter at /resource/runlogin.php...

CVE-2024-44838

RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the username parameter at /resource/runlogin.php...

CVE-2024-44727

Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php...

CVE-2024-44727

Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php...

python-django: Username enumeration through timing difference for users with unusable passwords

A vulnerability was found in Python-Django in the django.contrib.auth.backends.ModelBackend.authenticate method. This flaw allows remote attackers to enumerate users via a timing attack involving login requests for users with unusable passwords...

CVE-2024-8471

Cross-Site Scripting XSS vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through JOBID and USERNAME parameters in /jobportal/process.php...

CVE-2024-8471

CVE-2024-8471 concerns a Cross-Site Scripting (XSS) vulnerability in a Job Portal web application. The vulnerability arises from insufficient handling/encryption of user-controlled input in the /jobportal/process.php endpoint, with JOBID and USERNAME parameters being implicated. Exploitation coul...

PHPGurukul Job Portal Cross-site Scripting Vulnerability

PHPGurukul Job Portal is a PHP-based job search website system from PHPGurukul. A cross-site scripting vulnerability exists in PHPGurukul Job Portal version 1.0, which originates from the JOBID and USERNAME parameters in /jobportal/process.php...

CVE-2024-45589: Improper Restriction of Excessive Authentication Attempts

RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote attacker to cause a denial of service via the username parameters...

CVE-2024-45589

RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote attacker to cause a denial of service via the username parameters...

CVE-2024-8471: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through JOBID and USERNAME parameters in /jobportal/process.php...

CVE-2024-44727

Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php...