VMPanel Cross-Site Scripting Vulnerability

VMPanel is a website based on the VMware Esx/Esxi control panel and WHMCS plug-in. A cross-site scripting vulnerability exists in the username parameter of the VMPanel login page. As the program fails to adequately filter user-submitted input. An attacker could exploit this vulnerability to steal...

Multiple SQL Injection Vulnerabilities in ZZCMS 7.2

ZZCMS is an enterprise website builder. A SQL injection vulnerability exists in the username parameter on the /reg/userregcheckemail.php page, the bigclass parameter on the zt/zs.php page, and the pagesize parameter on the /zh/zh.php page. An attacker can exploit the vulnerabilities to obtain...

Exponent CMS 'username' Parameter SQL Injection Vulnerability

Exponent CMS is a free, open source PHP-based modular content management system CMS of the U.S. OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. Exponent CMS...

SQL Injection Vulnerability in fangmail Mail System

FangMail email system adopts distributed system architecture and built-in fourth-generation anti-spam gateway based on cloud technology. A SQL injection vulnerability exists in fangmail mail system. The lack of filtering of the 'username' parameter allows attackers to exploit the vulnerability to...

CVE-2016-4966

The diagnosiscontrol.php page in Fortinet FortiWan formerly AscernLink before 4.2.5 allows remote authenticated users to download PCAP files via vectors related to the UserName GET parameter...

Design/Logic Flaw

The diagnosiscontrol.php page in Fortinet FortiWan formerly AscernLink before 4.2.5 allows remote authenticated users to download PCAP files via vectors related to the UserName GET parameter...

SQL Injection Vulnerability in the Parameter txtUsername in the Login.aspx Page of Penta Software Education Management System

Pangda software education management system is .net development for vocational education WEB teaching management system. There is a SQL injection vulnerability in this product, the vulnerability URL is: http://target/NewPage/Login.aspx The vulnerability parameter is txtUsername and the type is PO...

SQL Injection Vulnerability in the Remote Consultation System of Beijing Blue Weather Technology Co.

BlueWell is a high-tech enterprise specializing in providing telemedicine services, and has constructed a nationwide telemedicine service platform, realizing a system platform for teleconsultation, specialist diagnosis, remote monitoring, surgical demonstration, two-way referral, remote education...

SQL Injection Vulnerability in Communication Application Server username Parameter of Shenou Communication Equipment Co.

Shenou Communication Equipment Co., Ltd. is a national non-regional enterprise integrating R&D, production, sales and service. Communication Application Server SOC1000 model products are softswitch servers for IP networks, supporting voice, fax and video at the same time. Shenou Communication...

KingCms v9 /user/manage.php username参数等2处SQL注入

No description provided by source...

CVE-2016-3968

Multiple cross-site scripting XSS vulnerabilities in Sophos Cyberoam CR100iNG UTM appliance with firmware 10.6.3 MR-1 build 503, CR35iNG UTM appliance with firmware 10.6.2 MR-1 build 383, and CR35iNG UTM appliance with firmware 10.6.2 Build 378 allow remote attackers to inject arbitrary web scrip...

京信通信/09/business/loginAction.php username参数命令执行漏洞

No description provided by source...

Shop7z v2.9 getpassword3.asp 文件 username 参数 SQL注入漏洞

No description provided by source...

Advantech WebAccess datacore Service datacore.exe Username strcpy Stack-Based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable instances of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x5218 IOCTL in the Kernel subsystem. A stack-based buffer...

ntopng Elevation of Privilege Vulnerability

ntopng is a new generation of cross-platform Web-based network traffic analysis and monitoring tools . The ntopng admin/passwordreset.lua file fails to adequately filter user cookies and the 'username' parameter, allowing remote attackers to exploit the vulnerability to change the login context a...

Code injection

ntopng aka ntop before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admin/passwordreset.lua...

CVE-2015-8368

ntopng aka ntop before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admin/passwordreset.lua...

SQL Injection Vulnerability in the username parameter of Wave Software Administrative Services System

The Administrative Service System ASS is a comprehensive administrative service system that integrates information and consultation, approval and charging, management and coordination, and complaints and supervision. A SQL injection vulnerability exists in the username parameter of WaveSoft...

Sophos Cyberoam CR500iNG-XP Firewall SQL Injection Vulnerability

Sophos Cyberoam CR500iNG-XP firewall appliance with CyberoamOS is a new-generation firewall from Sophos, UK, running the CyberoamOS operating system, which provides online application detection and control, web filtering, HTTPS checking, intrusion prevention and other features. It provides online...

CVE-2015-1389

Cross-site scripting XSS vulnerability in Aruba Networks ClearPass Policy Manager CPPM before 6.4.5 allows remote attackers to inject arbitrary web script or HTML via the username parameter to tips/tipsLoginSubmit.action...