163 matches found
CVE-2022-24223
AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php...
Sql injection
AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php...
CVE-2022-24223
AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php...
CVE-2022-24223: Improper Neutralization of Special Elements used in an SQL Command
AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php...
CVE-2021-42580: Improper Neutralization of Special Elements used in an SQL Command
Sourcecodester Online Learning System 2.0 is vunlerable to sql injection authentication bypass in admin login file /admin/login.php and authenticated file upload in Master.php file , we can craft these two vunlerablities to get unauthenticated remote command execution...
CVE-2021-41674: Improper Neutralization of Special Elements used in an SQL Command
An SQL Injection vulnerability exists in Sourcecodester E-Negosyo System 1.0 via the useremail parameter in /admin/login.php...
Sql injection
Online Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass vulnerability in /admin/login.php...
CVE-2021-37371: Improper Neutralization of Special Elements used in an SQL Command
Online Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass vulnerability in /admin/login.php...
E-Negosyo System 1.0 SQL Injection Vulnerability
Exploit Title: E-Negosyo System 1.0 - Time-Based Blind SQLi - admin/login.php Exploit Author: Janik Wehrli Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/bsenordering0.zip Version: 1.0 Category:...
CVE-2020-29214: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in SourceCodester Alumni Management System 1.0 allows the user to inject SQL payload to bypass the authentication via admin/login.php...
Sql injection
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=SQL, index.php?p=rooms&q=SQL, or admin/login.php...
CVE-2018-18800
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=SQL, index.php?p=rooms&q=SQL, or admin/login.php...
CVE-2018-18800: Improper Neutralization of Special Elements used in an SQL Command
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=SQL, index.php?p=rooms&q=SQL, or admin/login.php...
CVE-2019-7660: Improper Neutralization of Input During Web Page Generation
An issue was discovered in PHPMyWind 5.5. The username parameter of the /install/index.php page has a stored Cross-site Scripting XSS vulnerability, as demonstrated by admin/login.php...
CVE-2018-19221
CVE-2018-19221 affects LAOBANCMS 2.0. The vulnerability is a SQL injection via the admin/login.php guanliyuan parameter, as described across multiple connected sources. CVSS metrics from the initial document show an overall high/critical impact (CVSS2: 7.5; CVSS3: 9.8) with network access, no aut...
CVE-2018-19221: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in LAOBANCMS 2.0. It allows SQL Injection via the admin/login.php guanliyuan parameter...
CVE-2018-19224: Reliance on Cookies without Validation and Integrity Checking
An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies...
Authentication flaw
The checkpassword function in html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to bypass authentication via an empty password...
CVE-2011-4069: Improper Neutralization of Special Elements used in an LDAP Query
html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and consequently bypass authentication via a crafted username...
CVE-2011-4068: Improper Authentication
The checkpassword function in html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to bypass authentication via an empty password...