Xiuno BBS 访问控制错误漏洞

Xiuno BBS is an open source forum program based on PHP and MySQL. Xiuno BBS suffers from an Access Control Error vulnerability that stems from the product routeuser.php that allows retrieval of usernames. No details of the vulnerability are provided at this time...

CVE-2020-21493: Undefined Security Weakness

An issue in the component route\user.php of Xiuno BBS v4.0.4 allows attackers to enumerate usernames...

PT-2021-10630

Name of the Vulnerable Software and Affected Versions: Xiuno BBS version 4.0.4 Description: An issue in the component routeuser.php of Xiuno BBS allows attackers to enumerate usernames. Recommendations: For Xiuno BBS version 4.0.4, consider restricting access to the routeuser.php component to...

CVE-2021-41511: Improper Neutralization of Special Elements used in an SQL Command

The username and password field of login in Lodging Reservation Management System V1 can give access to any user by using SQL injection to bypass authentication...

CVE-2021-40970

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter...

CVE-2021-40970

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter...

CVE-2021-40970

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter...

CVE-2021-40970

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter...

CVE-2021-40970

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter...

CVE-2021-40970

Removed by vendor...

CVE-2021-41647

An un-authenticated error-based and time-based blind SQL injection vulnerability exists in Kaushik Jadhav Online Food Ordering Web App 1.0. An attacker can exploit the vulnerable "username" parameter in login.php and retrieve sensitive database information, as well as add an administrative user...

PT-2021-23366

Name of the Vulnerable Software and Affected Versions Kaushik Jadhav Online Food Ordering Web App version 1.0 Description An un-authenticated error-based and time-based blind SQL injection issue exists. An attacker can exploit the vulnerable username parameter in "login.php" and retrieve sensitiv...

CVE-2021-41647: Improper Neutralization of Special Elements used in an SQL Command

An un-authenticated error-based and time-based blind SQL injection vulnerability exists in Kaushik Jadhav Online Food Ordering Web App 1.0. An attacker can exploit the vulnerable "username" parameter in login.php and retrieve sensitive database information, as well as add an administrative user...

CVE-2021-40970: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter...

PT-2021-23025

Name of the Vulnerable Software and Affected Versions spotweb versions 1.5.1 and below Description The issue is a cross-site scripting XSS vulnerability in the templates/installer/step-004.inc.php file. This allows remote attackers to inject arbitrary web script or HTML via the username parameter...

Broker: discloses JDBC username and password in the application log file

A flaw was found in the AMQ Broker that discloses JDBC encrypted usernames and passwords when provided in the AMQ Broker application logfile when using the jdbc persistence functionality. Versions shipped in Red Hat AMQ 7 are vulnerable...

Cross Site Scripting (XSS)

zoneminder:edge is vulnerable to Cross Site Scripting XSS. It exists in ZoneMinder, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'username' parameter value in the view user user.php because proper filtration is omitted...

CVE-2021-39342

The CredovaFinancial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site user goes to checkout on a page that has the Credova Financing option enabled. This affects versions up to, and including, 1.4.8...

Replaying / intercepting a password reset POST request can allow for valid username enumeration

h3. Issue Summary Under certain conditions it's possible to enumerate valid usernames by replaying one of the password reset HTTP requests. h3. Steps to Reproduce Request a password reset email Open the password reset mail and click the link to open your browser Intercept the POST request of the...