EUVD-2023-33788

Malicious code in bioql PyPI...

CVE-2025-59768

Cross-site scripting XSS vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and...

PT-2025-39738

Name of the Vulnerable Software and Affected Versions code-projects Project Monitoring System version 1.0 Description A flaw exists in code-projects Project Monitoring System 1.0 that allows for SQL injection. The issue is located in an unknown function of the /login.php file. Manipulation of the...

CVE-2025-58960 WordPress IP Based Login Plugin <= 2.4.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in brijeshk89 IP Based Login ip-based-login allows Stored XSS.This issue affects IP Based Login: from n/a through = 2.4.3...

CVE-2025-10325

A vulnerability was identified in Wavlink WL-WN578W2 221110. This impacts the function sub401340/sub401BA4 of the file /cgi-bin/login.cgi. Such manipulation of the argument ipaddr leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might...

FXC Router Devices Default Credentials (HTTP)

The remote FXC router device is using known default credentials for the HTTP login. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

SQL Injection Vulnerability in Web Webmaster User Login of Xinhua San Technologies Co.

Xinhua San Technology Co., Ltd. is the industry's leading digital solutions leader, committed to becoming the most trusted partner for customers' business innovation and digital transformation. A SQL injection vulnerability exists in the Web network management user login of Xinhua San Technologie...

CVE-2023-2282

Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authenticated user to bypass administrator-enforced Web Login restrictions and gain access to entries via an unexpected vector...

CVE-2022-48538

In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cactildapauth allows a zero as the password...

CVE-2021-3824

OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL...

CVE-2020-14070

An issue was discovered in MK-AUTH 19.01. There is authentication bypass in the web login functionality because guessable credentials to admin/executarlogin.php result in admin access...

CVE-2019-1010287

Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may...

CVE-2022-2485

Any attempt good or bad to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its password in the communication packets...

PT-2024-33020 · Audiocodes · Audiocodes Mp-202B

Name of the Vulnerable Software and Affected Versions: Audiocodes MP-202b version 4.4.3 Description: The issue allows a remote attacker to escalate privileges via the login page of the web interface. This is due to a cross site scripting vulnerability. Recommendations: For version 4.4.3, consider...

D-Link DSL6740C 安全漏洞

The D-Link DSL6740C is a wireless VDSL router from China-based AUO D-Link. A security vulnerability exists in the D-Link DSL6740C, which can be exploited by an attacker to modify arbitrary user passwords and later log in to Web, SSH, and Telnet services via certain APIs...

CVE-2024-42423

Citrix Workspace App version 23.9.0.24.4 on Dell ThinOS 2311 contains an Incorrect Authorization vulnerability when Citrix CEB is enabled for WebLogin. A local unauthenticated user with low privileges may potentially exploit this vulnerability to bypass existing controls and perform unauthorized...

Cisco SSL VPN Bruteforce Login Utility

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco SSL VPN Bruteforce Login Utility', 'Description' = % This module scans for Cisco SSL VPN web login portals and performs login brute force t...

VMWare Web Login Scanner

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VMWare Web Login Scanner', 'Description' = 'This module attempts to authenticate to the VMWare HTTP service for VmWare Server, ESX, and ESXI',...

CVE-2024-3496

CVE-2024-3496 is an authentication-bypass flaw affecting Toshiba e-STUDIO multifunction printers. Public sources in the connected documents describe a vulnerability where network-adjacent attackers can bypass web login authentication, gaining access to system information and the ability to upload...

The vulnerability of the cgi-bin/login.cgi file within the Sangfor NGAF firewall allows a hacker to execute arbitrary code.

The vulnerability of the cgi-bin/login.cgi file, exposed by the Sangfor NGAF firewall mechanism, is related to errors in processing the meta-symbolic cookie file in the PHPSESSID parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially...