12652 matches found
Authentication flaw
The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hiddenformdata' function. This makes it possible for authenticated attackers to log in as...
CVE-2023-3457
A vulnerability was found in SourceCodester Shopping Website 1.0. It has been classified as critical. Affected is an unknown function of the file index.php. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclos...
CVE-2023-3447
The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5. This is due to insufficient escaping on the supplied username value. This makes it possible for unauthenticated attackers to extract potentially...
PT-2023-24927 · Unknown · Sourcecodester Shopping Website
Name of the Vulnerable Software and Affected Versions: SourceCodester Shopping Website version 1.0 Description: A critical issue has been found, affecting an unknown function of the file index.php. The manipulation of the username argument leads to sql injection, allowing remote attacks. The...
Web3 – Crypto wallet Login & NFT token gating < 2.7.0 - Authentication Bypass
The plugin does not properly perform authentication in the 'hiddenformdata' function, allowing an unauthenticated user to log in as any existing user on the site, such as an administrator, if they have access to the username...
SourceCodester Shopping Website SQL注入漏洞
SourceCodester Shopping Website is a shopping website type CMS. A SQL injection vulnerability exists in SourceCodester Shopping Website version 1.0, which stems from a problem in the file index.php, where manipulation of the parameter username can lead to sql injection...
WordPress plugin Active Directory Integration/LDAP Integration 注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An injection vulnerability exists in...
PT-2023-3437 · WordPress · Active Directory Integration / Ldap Integration
Name of the Vulnerable Software and Affected Versions: Active Directory Integration / LDAP Integration plugin for WordPress versions up to, and including, 4.1.5 Description: The issue is related to insufficient escaping on the supplied username value, which makes it possible for unauthenticated...
Active Directory Integration / LDAP Integration < 4.1.6 - Sensitive Information Disclosure
The plugin will expose Sensitive Information due to insufficient sanitization of the supplied username value...
Improper access control
Incorrect access control in the component /index.php?mod=system&op=orgtree of dzzoffice 2.02.1SCUTF8 allows unauthenticated attackers to browse departments and usernames...
CVE-2023-22359
CVE-2023-22359 describes a user-enumeration issue in Checkmk versions up to 2.2.0p4. The provided documents consistently frame the vulnerability as an authenticated user enumeration of usernames, without detailing specific exploit steps, affected modules, or exploitability in the wild. No concret...
CVE-2023-22359 User-enumeration in RestAPI
User enumeration in Checkmk =2.2.0p4 allows an authenticated attacker to enumerate usernames...
Citrix FAS - Incorrect username and password
Incorrect username and password FAS After launching desktop when users tries to log on. No error on the certificates, no error in "Application" and "System" in the FAS server. VDA event logs Windows logs Security and looking for audit failure at the same time as the login failure: 0xC000006A| use...
Checkmk 安全漏洞
Checkmk is an editor. A security vulnerability exists in Checkmk version 2.2.0p4 and earlier versions, which stems from a vulnerability that allows an authenticated attacker to enumerate usernames...
Acon Architecture and Construction Website CMS 1.2 Insecure Settings
==================================================================================================================================== | Title : Acon - Architecture and Construction Website CMS v1.2 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro /...
CVE-2023-33584
Sourcecodester Enrollment System Project V1.0 is vulnerable to SQL Injection SQLI attacks, which allow an attacker to manipulate the SQL queries executed by the application. The application fails to properly validate user-supplied input in the username and password fields during the login process...
PT-2023-24397 · Sourcecodester · Sourcecodester Enrollment System Project
Name of the Vulnerable Software and Affected Versions: Sourcecodester Enrollment System Project version V1.0 Description: The issue concerns SQL Injection SQLI attacks, which allow an attacker to manipulate the SQL queries executed by the application. This is due to the application's failure to...
CVE-2023-34666
Cross-site scripting XSS vulnerability in Phpgurukul Cyber Cafe Management System 1.0 allows remote attackers to inject arbitrary web script or HTML via the admin username parameter...
