CVE-2023-49259 Bruteforcing authentication cookie for a given user

The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up-time, and can be guessed in a reasonable time...

PT-2024-15591 · Code Projects · Dormitory Management System

Name of the Vulnerable Software and Affected Versions: code-projects Dormitory Management System version 1.0 Description: A critical vulnerability was found in the Dormitory Management System. The issue affects an unknown functionality of the file login.php. The manipulation of the username...

Hongdian Router H8951-4G-ESP Security Vulnerability

The Hongdian Router H8951-4G-ESP is a wireless router from China Hongdian. A security vulnerability exists in versions prior to Hongdian H8951-4G-ESP 2310271149, which stems from the authentication cookie being generated using an algorithm based on a username, hard-coded password, and uptime, and...

PT-2024-13716 · Hongdian · H8951-4G-Esp +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The authentication cookies are generated using an algorithm based on the username, a hardcoded secret, and the up-time, and can be guessed in a reasonab...

CVE-2024-23059

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the username parameter in the setDdnsCfg function...

CVE-2024-23059

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the username parameter in the setDdnsCfg function...

Hubbub Lite < 1.32.0 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup As admin, enable the 'Floating Sidebar...

PT-2024-19650 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version V17.0.0cu.557 B20221024 Description: A command injection issue was discovered via the username parameter in the setDdnsCfg function. This allows for potential exploitation. Recommendations: For TOTOLINK A3300R version...

CVE-2024-23059

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the username parameter in the setDdnsCfg function...

CVE-2020-26628

A Cross-Site Scripting XSS vulnerability was discovered in Hospital Management System V4.0 which allows an attacker to execute arbitrary web scripts or HTML code via a malicious payload appended to a username on the 'Edit Profile" page and triggered by another user visiting the profile...

Hospital Management System 跨站脚本漏洞

A Hospital Management System HMS is a computerized system that helps manage healthcare-related information and helps healthcare providers do their jobs effectively. A cross-site scripting vulnerability exists in Hospital Management System V4.0, which stems from the application's lack of effective...

Simple Online Hotel Reservation System SQL Injection Vulnerability

Simple Online Hotel Reservation System is an online hotel reservation system. Simple Online Hotel Reservation System suffers from a SQL injection vulnerability that originates in the login.php username and password parameters...

keycloak: LDAP injection on username input

A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other malicious actions...

keycloak: LDAP injection on username input

A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other malicious actions...

keycloak: LDAP injection on username input

A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other malicious actions...

Online Food Ordering System SQL Injection Vulnerability

Online Food Ordering System is an online food ordering system from the individual developer Carlo Montero. A SQL injection vulnerability exists in CodeAstro Online Food Ordering System version 1.0, which originates when /admin/ in the component Admin Panel contains unknown code that causes SQL...

PT-2024-15409 · Unknown · Codeastro Online Food Ordering System

Name of the Vulnerable Software and Affected Versions: CodeAstro Online Food Ordering System version 1.0 Description: A critical vulnerability was found in the Admin Panel component of the CodeAstro Online Food Ordering System. The manipulation of the Username argument leads to SQL injection. The...

PT-2024-13983 · Unknown · Travel Website

Name of the Vulnerable Software and Affected Versions: Travel Website version 1.0 Description: The issue affects the login functionality, specifically the username parameter of the "loginAction.php" resource, which does not validate input characters. These characters are sent unfiltered to the...

Travel Website SQL Injection Vulnerability

Travel Website is a PHP-based travel website. A SQL injection vulnerability exists in Travel Website v1.0, which occurs when the username parameter of the loginAction.php page is processed without filtering before sending the data to the database for processing...

RRJ Nueva Ecija Engineer Online Portal Cross-Site Scripting Vulnerability

RRJ Nueva Ecija Engineer Online Portal is an online portal for engineers from RRJ Nueva Ecija. A cross-site scripting vulnerability exists in RRJ Nueva Ecija Engineer Online Portal version 1.0, which stems from the parameter Firstname/Lastname/Username in the file /admin/adminuser.php that causes...