CVE-2023-28628

lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 authority-regex allows an attacker to send malicious URLs to be parsed by the lambdaisland/uri and return the wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in questio...

D-Link DNR-322L <=2.60B15 - Authenticated Remote Code Execution Exploit

Exploit Title: D-Link DNR-322L Exploit Writeup: https://lukasec.ch/posts/dlinkdnr322.html Vendor Homepage: https://dlink.com Vendor Advisory: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10305 Software Link: http://legacyfiles.us.dlink.com/DNR-322L/REVA/FIRMWARE...

FlatCore CMS 2.1.1 - Stored Cross-Site Scripting (XSS)

Exploit Title: FlatCore CMS 2.1.1 -Stored Cross Site Scripting Date: 2020-09-24 Exploit Author: Sinem Şahin Vendor Homepage: https://flatcore.org/ Version: 2.1.1 Tested on: Windows & XAMPP == Tutorial http://HOST/install/index.php 2- Write XSS Payload into the username of the user account. 3- Pre...

CVE-2023-1557 SourceCodester E-Commerce System Username access control

A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ecommerce/admin/user/controller.php?action=edit of the component Username Handler. The manipulation of the argument USERID leads to...

CVE-2023-1557: Improper Access Control

A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ecommerce/admin/user/controller.php?action=edit of the component Username Handler. The manipulation of the argument USERID leads to...

CVE-2023-1506

A vulnerability, which was classified as critical, was found in SourceCodester E-Commerce System 1.0. Affected is an unknown function of the file login.php. The manipulation of the argument UUSERNAME leads to sql injection. It is possible to launch the attack remotely. The complexity of an attack...

CURL-CVE-2023-27533 TELNET option IAC injection

curl supports communicating using the TELNET protocol and as a part of this it offers users to pass on username and "telnet options" for the server negotiation. Due to lack of proper input scrubbing and without it being the documented functionality, curl would pass on username and telnet options ...

UBUNTU-CVE-2023-27533

A vulnerability in input validation exists in curl 8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform...

PT-2023-17041 · Sourcecodester · Sourcecodester E-Commerce System

Name of the Vulnerable Software and Affected Versions: SourceCodester E-Commerce System version 1.0 Description: A critical issue was found in the system, allowing for sql injection through the manipulation of the U USERNAME argument in an unknown function of the login.php file. This issue can be...

PT-2023-17039 · Unknown · Sourcecodester Alphaware Simple E-Commerce System

Name of the Vulnerable Software and Affected Versions: SourceCodester Alphaware Simple E-Commerce System version 1.0 Description: A critical issue has been found in the SourceCodester Alphaware Simple E-Commerce System, affecting an unknown part of the file admin/admin index.php. The manipulation...

Alphaware Simple E-Commerce System SQL Injection Vulnerability

Alphaware Simple E-Commerce System is an e-commerce system by razormist individual developers. A SQL injection vulnerability exists in Alphaware Simple E-Commerce System version 1.0, which is caused by incorrect manipulation of the username/password parameters...

CVE-2023-1503: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical has been found in SourceCodester Alphaware Simple E-Commerce System 1.0. This affects an unknown part of the file admin/adminindex.php. The manipulation of the argument username/password with the input admin' AND SELECT 8062 FROM SELECTSLEEP5meUD-- hLiX lead...

Canteen Management System SQL Injection Vulnerability

Canteen Management System is a cafeteria management system by Mayuri K. Individual developer. A SQL injection vulnerability exists in SourceCodester Canteen Management System version 1.0, which stems from the presence of an unknown function in changeUsername.php that leads to SQL injection via th...

CVE-2023-27040

Simple Image Gallery v1.0 was discovered to contain a remote code execution RCE vulnerability via the username parameter...

Remote code execution

Simple Image Gallery v1.0 was discovered to contain a remote code execution RCE vulnerability via the username parameter...

PT-2023-20913 · Unknown · Simple Image Gallery

Name of the Vulnerable Software and Affected Versions: Simple Image Gallery version 1.0 Description: The issue is related to a remote code execution RCE vulnerability. This vulnerability can be exploited via the username parameter. Recommendations: For Simple Image Gallery version 1.0, as a...

CVE-2023-27040: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Simple Image Gallery v1.0 was discovered to contain a remote code execution RCE vulnerability via the username parameter...

CVE-2023-27040

Simple Image Gallery v1.0 was discovered to contain a remote code execution RCE vulnerability via the username parameter...

CVE-2023-27040

Simple Image Gallery v1.0 was discovered to contain a remote code execution RCE vulnerability via the username parameter...

CVE-2022-39214

CVE-2022-39214 (Combodo iTop) : Authenticated users can take over any account by knowing the target username. Affected: iTop prior to 2.7.8 and 3.0.2-1. Root cause: horizontal account takeover due to login handling. Impact: total account takeover with high confidentiality/integrity/availability i...