CVE-2020-8547: Undefined Security Weakness

phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters...

PT-2020-20200 · Phplist · Phplist

Name of the Vulnerable Software and Affected Versions: phpList version 3.5.0 Description: The issue allows for admin login bypass due to type juggling. This occurs because the code uses == for password hash comparison instead of ===, which can mishandle hashes starting with 0e followed by numeric...

CVE-2020-8087

SMC Networks D3G0804W D3GNV5M-3.5.1.6.10GA devices allow remote command execution by leveraging access to the Network Diagnostic Tools screen, as demonstrated by an admin login. The attacker must use a Parameter Pollution approach against goform/formSetDiagnosticToolsFmPing by providing the...

CVE-2011-3622

A Cross-Site Scripting XSS vulnerability exists in the admin login screen in Phorum before 5.2.18...

Cross site scripting

A Cross-Site Scripting XSS vulnerability exists in the admin login screen in Phorum before 5.2.18...

CVE-2011-3622

A Cross-Site Scripting XSS vulnerability exists in the admin login screen in Phorum before 5.2.18...

CVE-2011-3622

CVE-2011-3622 describes an XSS vulnerability in the admin login screen of the Phorum web forum software prior to version 5.2.18. The issue is documented across multiple sources (NVD) as a Cross-Site Scripting vulnerability, with impact details indicating user interaction may be required depending...

CVE-2011-3622

A Cross-Site Scripting XSS vulnerability exists in the admin login screen in Phorum before 5.2.18...

CVE-2011-3622: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability exists in the admin login screen in Phorum before 5.2.18...

PT-2020-7127

Name of the Vulnerable Software and Affected Versions Phorum versions prior to 5.2.18 Description A Cross-Site Scripting XSS issue exists in the admin login screen. This allows for potential malicious script execution. Recommendations For versions prior to 5.2.18, update to version 5.2.18 or late...

CVE-2020-7470

Sonoff TH 10 and 16 devices with firmware 6.6.0.21 allows XSS via the Friendly Name 1 field after a successful login with the Web Admin Password...

CVE-2020-7249

SMC D3G0804W 3.5.2.5-LATGA devices allow XSS via the SSID field on the WiFi Network Configuration page after a successful login to the admin account...

CVE-2020-7249

SMC D3G0804W 3.5.2.5-LATGA devices allow XSS via the SSID field on the WiFi Network Configuration page after a successful login to the admin account...

Car Rental Project 1.0 Remote Code Execution

Exploit Title: Car Rental Project v.1.0 Remote Code Execution Google Dork: N/A Date: 1/3/2020 Exploit Author: FULLSHADE Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/car-rental-project-php-mysql-free-download/ Version: 1.0 Tested on: Windows CVE : CVE-2020-5509...

CVE-2020-5511

PHPGurukul Small CRM v2.0 was found vulnerable to authentication bypass via SQL injection when logging into the administrator login page...

Universal Password Bypass Vulnerability in Xusoft09 System Enterprise SEO Site

XUsoft09 fully static article system based on asp can be used to build self-presentation type websites for individuals, small and medium-sized enterprises or other organizations. Xusoft09 system enterprise SEO station exists universal password bypass vulnerability, attackers can use the...

SQL Injection Vulnerability in Background Login of Duan Yun Chemical Website System V2.01 System

Duanyun chemical website system is a professional chemical website construction system, which supports full static website processing, big data chemical products batch import, professional version provides structured search and other services. Duanyun chemical website system V2.01 system backgrou...

CVE-2013-4982

CVE-2013-4982 affects AVTECH AVN801 DVRs; authentication bypass is possible by using the login=quick parameter to bypass the login verification code, potentially granting unauthorized access to feeds or device settings. The issue stems from bypassing the admin login captcha, enabling access witho...

Code injection

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094...

CVE-2019-4716

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as “admin”, and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value:...