CVE-2011-3622

CVE-2011-3622 describes an XSS vulnerability in the admin login screen of the Phorum web forum software prior to version 5.2.18. The issue is documented across multiple sources (NVD) as a Cross-Site Scripting vulnerability, with impact details indicating user interaction may be required depending...

CVE-2011-3622

A Cross-Site Scripting XSS vulnerability exists in the admin login screen in Phorum before 5.2.18...

CVE-2020-7249

SMC D3G0804W 3.5.2.5-LATGA devices allow XSS via the SSID field on the WiFi Network Configuration page after a successful login to the admin account...

Car Rental Project 1.0 Remote Code Execution

Exploit Title: Car Rental Project v.1.0 Remote Code Execution Google Dork: N/A Date: 1/3/2020 Exploit Author: FULLSHADE Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/car-rental-project-php-mysql-free-download/ Version: 1.0 Tested on: Windows CVE : CVE-2020-5509...

CVE-2020-5511

PHPGurukul Small CRM v2.0 was found vulnerable to authentication bypass via SQL injection when logging into the administrator login page...

Universal Password Bypass Vulnerability in Xusoft09 System Enterprise SEO Site

XUsoft09 fully static article system based on asp can be used to build self-presentation type websites for individuals, small and medium-sized enterprises or other organizations. Xusoft09 system enterprise SEO station exists universal password bypass vulnerability, attackers can use the...

SQL Injection Vulnerability in Background Login of Duan Yun Chemical Website System V2.01 System

Duanyun chemical website system is a professional chemical website construction system, which supports full static website processing, big data chemical products batch import, professional version provides structured search and other services. Duanyun chemical website system V2.01 system backgrou...

CVE-2013-4982

CVE-2013-4982 affects AVTECH AVN801 DVRs; authentication bypass is possible by using the login=quick parameter to bypass the login verification code, potentially granting unauthorized access to feeds or device settings. The issue stems from bypassing the admin login captcha, enabling access witho...

Code injection

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094...

CVE-2019-4716

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as “admin”, and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value:...

PT-2019-6107 · Ibm · Ibm Planning Analytics

Name of the Vulnerable Software and Affected Versions: IBM Planning Analytics versions 2.0.0 through 2.0.8 Description: The issue is related to a configuration overwrite that allows an unauthenticated user to login as admin and then execute code as root or SYSTEM via TM1 scripting. This is due to...

Empire CMS core encryption algorithm has logic flaws

Empire CMS it is based on B/S structure, Empire CMS-logo easy-to-use website management system. It is a well-designed and efficient website solution for Linux/windows/Unix and other environments. Empire CMS core encryption algorithm has a logical loophole, attackers can use the vulnerability to...

CVE-2019-17600

CVE-2019-17600 affects Intelbras IWR 1000N with firmware 1.6.4. The issue is a mishandling of v1/system/user that leads to disclosure of the administrator login name and password. The Red Hat and NVD entries confirm the same vulnerability family; exploitation is referenced in public exploit mater...

CVE-2019-17600

Intelbras IWR 1000N 1.6.4 devices allow disclosure of the administrator login name and password because v1/system/user is mishandled...

Top Echelon Software: able to login into login.topechelon.com

The support login for our administrative account was using insecure credentials, allowing access to our administrative account. These credentials are not used, so we chose to deactivate the login to prevent access...

CVE-2019-16238

Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login...

Unauthorized Access Vulnerability in Schneider Electric Modicon M340 PLCs

Schneider Electric Modicon M340 is a medium-sized PLC from Schneider Electric, which has a wide range of applications in the industrial control field in China. An unauthorized access vulnerability exists in the Schneider Electric Modicon M340 PLC. The vulnerability can be exploited to obtain...

PT-2019-3020 · Cisco · Cisco Ucs Director Express For Big Data +2

Name of the Vulnerable Software and Affected Versions: Cisco Integrated Management Controller IMC Supervisor versions affected versions not specified Cisco UCS Director versions affected versions not specified Cisco UCS Director Express for Big Data versions affected versions not specified...

UNA 10.0.0 RC1 Cross Site Scripting

Exploit Title: UNA - 10.0.0-RC1 stored XSS vuln. Date: 2019 08 10 Exploit Author: Greg.Priest Vendor Homepage: https://una.io/ Software Link: https://github.com/unaio/una/tree/master/studio Version: UNA - 10.0.0-RC1 Tested on: Windows/Linux CVE : CVE-2019-14804 UNA-v.10.0.0-RC1 Stored XSS...

CVE-2019-10119

eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID via an invalid login attempt to the RemoteApi account, aka HMCCU-154. This leads to automatic login as admin...