2713 matches found
CVE-2022-40000
Cross Site Scripting XSS vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the admin log in page...
Ricoh IPSiO SP 4210 跨站脚本漏洞
The Ricoh IPSiO SP 4210 is a laser printer from Ricoh Japan. A security vulnerability exists in the Ricoh IPSiO SP 4210, which can be exploited by an attacker to execute arbitrary scripts on the web browser of a user who logs into the product with administrative privileges...
PT-2022-24989 · Unknown · Pingkon Hms-Php
Name of the Vulnerable Software and Affected Versions: Pingkon HMS-PHP affected versions not specified Description: A critical issue affects the processing of the file admin/adminlogin.php, where the manipulation of the uname/pass argument leads to sql injection. The attack can be initiated...
HMS-PHP 安全漏洞
HMS-PHP is a CSE309 IUB final web application project by the individual developer Pingkon Augustine Rozario. A security vulnerability exists in HMS-PHP that stems from some unknown processing in the file admin/adminlogin.php being affected, where manipulation of the parameter uname/pass can lead ...
PT-2022-6348 · Dell Emc · Dell Emc Scg Policy Manager
Name of the Vulnerable Software and Affected Versions: Dell EMC SCG Policy Manager versions 5.10 through 5.12 Description: The issue is related to a Hard-coded Cryptographic Key, which could allow an attacker with knowledge of the hard-coded sensitive information to potentially exploit this...
CVE-2022-41541
TP-Link AX10v1 V1211117 allows attackers to execute a replay attack by using a previously transmitted encrypted authentication message and valid authentication token. Attackers are able to login to the web application as an admin user...
CVE-2022-41541
TP-Link AX10v1 V1211117 allows attackers to execute a replay attack by using a previously transmitted encrypted authentication message and valid authentication token. Attackers are able to login to the web application as an admin user...
Authentication flaw
TP-Link AX10v1 V1211117 allows attackers to execute a replay attack by using a previously transmitted encrypted authentication message and valid authentication token. Attackers are able to login to the web application as an admin user...
CVE-2022-41541
TP-Link AX10v1 (firmware V1_211117) is vulnerable to a replay attack where an attacker reuses a previously encrypted authentication message and valid token, enabling login to the web admin interface. The available sources confirm the authentication flaw and admin access possibility; no explicit e...
CVE-2022-42237
A SQL Injection issue in Merchandise Online Store v.1.0 allows an attacker to log in to the admin account...
CVE-2022-42237
CVE-2022-42237 affects Merchandise Online Store v1.0, exposing an SQL Injection in the login/auth workflow that can allow an attacker to log in to an admin account. The vulnerability is classified as CRITICAL (CVSS 3.1: 9.8) with network attack vector, no privileges, and no user interaction requi...
CVE-2022-3495 SourceCodester Simple Online Public Access Catalog Admin Login sql injection
A vulnerability has been found in SourceCodester Simple Online Public Access Catalog 1.0 and classified as critical. This vulnerability affects unknown code of the file /opac/Actions.php?a=login of the component Admin Login. The manipulation of the argument username/password leads to sql injectio...
CVE-2022-3495 SourceCodester Simple Online Public Access Catalog Admin Login sql injection
A vulnerability has been found in SourceCodester Simple Online Public Access Catalog 1.0 and classified as critical. This vulnerability affects unknown code of the file /opac/Actions.php?a=login of the component Admin Login. The manipulation of the argument username/password leads to sql injectio...
PT-2022-22448 · Sourcecodester · Sourcecodester Simple Online Public Access Catalog
Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Online Public Access Catalog version 1.0 Description: A critical issue has been discovered, affecting the Admin Login component, specifically the /opac/Actions.php?a=login endpoint. The manipulation of the username and...
Web-Based Student Clearance System SQL Injection Vulnerability
Web-Based Student Clearance System is a web-based student clearance system from the personal developer Ndueso Okorie.A SQL injection vulnerability exists in Web-Based Student Clearance System, which stems from the lack of validation of external input SQL statements in the parameter txtusername in...
Sql injection
A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. Affected is an unknown function of the file /Admin/login.php of the component POST Parameter Handler. The manipulation of the argument txtusername leads to sql injection. It is...
Web-Based Student Clearance System SQL注入漏洞
Web-Based Student Clearance System is a web-based student clearance system from the personal developer Ndueso Okorie.A SQL injection vulnerability exists in Web-Based Student Clearance System, which stems from the lack of validation of external input SQL statements in the parameter txtusername in...
Password can be set extremely weak
Description In this scenario, I use the demo website. It allows us to add more user to test. With password, we can set it 1 Or any charater. There is no policy for password or no password checking. Moreover, it also allows us to change password and the new password also can be set with password...
