CVE-2017-10676

On D-Link DIR-600M devices before C1v3.05ENB01beta20170306, XSS was found in the form2userconfig.cgi username parameter...

Design/Logic Flaw

On D-Link DIR-600M devices before C1v3.05ENB01beta20170306, XSS was found in the form2userconfig.cgi username parameter...

CVE-2017-10676

On D-Link DIR-600M devices before C1v3.05ENB01beta20170306, XSS was found in the form2userconfig.cgi username parameter...

Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting XSS attacks. The attacks exist because lib/classes/event/userloginfailed.php does not escape the user-supplied username before returning it to the description during invalid login-attempt. This allows a malicious user to inject and execute arbitrary co...

Teltonika RUT9XX Router Arbitrary Command Execution Vulnerability

Teltonika RUT9XX routers also known as LuCI is a router product from the Lithuanian company Teltonika. A security vulnerability exists in the administration interface of Teltonika RUT9XX routers with firmware version 00.03.265 and earlier. The vulnerability can be exploited by a remote attacker t...

CVE-2017-8116

The management interface for the Teltonika RUT9XX routers aka LuCI with firmware 00.03.265 and earlier allows remote attackers to execute arbitrary commands with root privileges via shell metacharacters in the username parameter in a login request...

CVE-2017-8116

The management interface for the Teltonika RUT9XX routers aka LuCI with firmware 00.03.265 and earlier allows remote attackers to execute arbitrary commands with root privileges via shell metacharacters in the username parameter in a login request...

Cross-site scripting vulnerability in the username parameter of the login.jsp file of the Air English Classroom Campus Education Cloud Platform

The Air English Classroom Campus Education Cloud Platform is a digital English online teaching system. A reflective cross-site scripting vulnerability exists in the username parameter of the login.jsp file of the Air English Classroom Campus Education Cloud Platform, due to the system's failure t...

UBUNTU-CVE-2017-9781

A cross site scripting XSS vulnerability exists in CheckMK versions 1.4.0x prior to 1.4.0p6, allowing an unauthenticated remote attacker to inject arbitrary HTML or JavaScript via the username parameter when attempting authentication to webapi.py, which is returned unencoded with content type...

Schneider Electric U.motion Builder Remote Code Execution Vulnerability

U.motion Builder is a builder product from Schneider Electric France. A remote code execution vulnerability exists in Schneider Electric U.motion Builder. The underlying SQLite database query performs SQL injection on the username input parameter. A remote attacker can exploit the vulnerability t...

CVE-2016-9834

An XSS vulnerability allows remote attackers to execute arbitrary client side script on vulnerable installations of Sophos Cyberoam firewall devices with firmware through 10.6.4. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

EML enterprise address book management system username parameter has SQL injection vulnerability

EML enterprise address book management system to the enterprise employees at any time, any place to provide enterprise address book information, can be in the cell phone real-time view of the staff contact information, dialing the phone and so on. The EML enterprise address book management system...

SQL Injection Vulnerability in J_username Parameter of Spotlight Technology Air Quality Online Monitoring System

The Air Quality Online Monitoring System is a system produced by Spotlight Technology that can realize online automatic monitoring of regional air quality. A SQL injection vulnerability exists in the jusername parameter of Spotlight Technology's Air Quality Online Monitoring System, which allows...

SQL Injection Vulnerability in Shield Spirit Public Number Promotion System yaoqinguser.php

Shield Spirit public number promotion system is a public number promotion system for individuals and businesses. Shield Spirit public number promotion system yaoqinguser.php SQL injection vulnerability, due to the lack of 'username' parameter filtering, allowing attackers to exploit the...

Cell Phone Remote Lighting Monitoring System SQL Injection Vulnerability in txtUsername Parameter

Mobile Remote Lighting Monitoring System is a lighting monitoring system from China Electronic Technology Group Corporation. A SQL injection vulnerability exists in the Mobile Remote Lighting Monitoring System. The lack of filtering of the 'txtUsername' parameter allows an attacker to exploit the...

CVE-2017-7410

Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username, 2 displayname parameter...

Moxa AWK-3131A 1.4 1.7 - Username OS Command Injection

Moxa AWK-3131A 1.4 1.7 - Username OS Command Injection !/usr/bin/env python2 import telnetlib import re import random import string Split string into chunks, of which each is /var/a' - 1 completed = temp = re.split'\n', script for content in temp: if lencontent != 0: for s in re.split' ', content...

Reflective cross-site scripting vulnerability in multiple parameters of DuoDuo Rebate System V8.3_UTF8 official version

DuoDuo rebate system is for e-commerce rebate, shopping guide to provide solutions, is the open source PHP rebate site system. DuoDuoRebate.com system V8.3UTF8 official version February 10, 2017 There is a reflective cross-site scripting vulnerability. Due to the code parameter , ddusername...

GOsa Cross-Site Scripting Vulnerability

GOsa is a set of LDAP front-end tools for managing users. A cross-site scripting vulnerability exists in the 'displayLogin' function of the html/index.php file in GOsa. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of a username...

SQL Injection Vulnerability in Shield Spirit Public Number Promotion System reg.php Page

Shield Spirit Public Promotion System is a product that is mainly applied to public promotion alliance. A SQL injection vulnerability exists in the username parameter of the Shield Spirit public number promotion system \php\reg.php page. An attacker can exploit the vulnerability to obtain sensiti...