12585 matches found
CVE-2025-43928
In Infodraw Media Relay Service MRS 7.1.0.0, the MRS web server on port 12654 allows reading arbitrary files via ../ directory traversal in the username field. Reading ServerParameters.xml may reveal administrator credentials in cleartext or with MD5 hashing...
CVE-2025-43919
GNU Mailman 2.1.39, as bundled in cPanel and WHM, allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman aka the private archive authentication endpoint via the username parameter. NOTE: multiple third parties report that they are unable t...
CVE-2025-3799
A vulnerability, which was classified as critical, was found in WCMS 11. Affected is an unknown function of the file app/controllers/AnonymousController.php. The manipulation of the argument email/username leads to sql injection. It is possible to launch the attack remotely. The exploit has been...
WCMS 注入漏洞
WCMS is a content management system CMS from the individual developers at Vedegis. An injection vulnerability exists in WCMS version 11, which stems from SQL injection due to the manipulation of the parameters email and username in the file app/controllers/AnonymousController.php...
SAP KMC WPC Information Disclosure Vulnerability
SAP KMC WPC is a combination of enterprise content management and web publishing components from SAP. An information disclosure vulnerability exists in SAP KMC WPC, which can be exploited by an attacker to retrieve a user name via a simple parameter query, resulting in the disclosure of sensitive...
📄 UJCMS 9.6.3 Insecure Direct Object Reference
UJCMS version 9.6.3 suffers from an insecure direct object reference vulnerability that enables user enumeration. Exploit Title: UJCMS 9.6.3 User Enumeration via IDOR Exploit Author: Cyd Tseng Date: 11 Dec 2024 Category: Web application Vendor Homepage: https://dromara.org/ Software Link:...
UJCMS 9.6.3 - User Enumeration via IDOR
Exploit Title: UJCMS 9.6.3 User Enumeration via IDOR Exploit Author: Cyd Tseng Date: 11 Dec 2024 Category: Web application Vendor Homepage: https://dromara.org/ Software Link: https://github.com/dromara/ujcms Version: UJCMS 9.6.3 Tested on: Linux CVE: CVE-2024-12483 Advisory:...
Inventio Lite 4 - SQL Injection
Exploit Title: Inventio Lite 4 - SQL Injection Error Based SQLi in "username" parameter on "/?action=processlogin." Date: 08/21/2024 Exploit Author: pointedsec Vendor Homepage: http://evilnapsis.com Software Link: https://github.com/evilnapsis/inventio-lite Version: ' or email LIKE '' and passwor...
CVE-2025-27927
An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API...
CVE-2025-30254
An unauthenticated attacker can obtain a serial number of a smart meters using its owner's username...
CVE-2025-27568
An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request...
CVE-2025-24487
An unauthenticated attacker can infer the existence of usernames in the system by querying an API...
CVE-2025-31941
An unauthenticated attacker can obtain a list of smart devices by knowing a valid username...
CVE-2025-31357
An unauthenticated attacker can obtain a user's plant list by knowing the username...
CVE-2024-11084
Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists...
Usermin 2.100 - Username Enumeration
Exploit Title: Usermin 2.100 - Username Enumeration Date: 10.02.2024 Exploit Author: Kjesper Vendor Homepage: https://www.webmin.com/usermin.html Software Link: https://github.com/webmin/usermin Version: = 2.100 Tested on: Kali Linux CVE: CVE-2024-44762...
CVE-2025-27927
An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API...
CVE-2025-27927
CVE-2025-27927 concerns Growatt Cloud Applications (Growatt Cloud portal). Connected sources describe a vulnerability where an unauthenticated attacker can determine a list of smart devices by querying an unprotected API using a valid username, indicating weak access control on user-oriented API ...