CVE-2025-30344

An issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/ endpoint, the system's response times differ depending on whether a user exists in the system. The timing discrepancy stems from the omitted hashing of the password e.g., more than 100 milliseconds...

CVE-2024-57587: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the 1 username or 2 password parameter to /api/auth/login...

PT-2024-22354

Name of the Vulnerable Software and Affected Versions Directus versions prior to 10.10.0 Description The authentication API has a redirect parameter that can be exploited as an open redirect vulnerability when a user tries to log in via the API URL. After a successful login via the Auth API GET...

CVE-2023-40519: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the bpk-common/auth/login/index.html login portal in Broadpeak Centralized Accounts Management Auth Agent 01.01.00.19219575ee9195b0, 01.01.01.30097902fd999e76, and 00.12.01.95655881254b459 allows remote attackers to inject arbitrary web script or HTML v...

Stackposts Social Marketing Tool 1.0 SQL Injection

Exploit Title: Stackposts Social Marketing Tool v1.0 - SQL Injection Date: 2023-05-17 Exploit Author: Ahmet Ümit BAYRAM Vendor: https://codecanyon.net/item/stackposts-social-marketing-tool/21747459 Demo Site: https://demo.stackposts.com Tested on: Kali Linux CVE: N/A Request POST /spmo/auth/login...

WS-2023-0089

An object injection vulnerability was found in stripe-billing-typographic GitHub project via /auth/login. It is possible to use an object injection failure to achieve a sql injection, where attacker uses the means to bypass authentication, requiring only a valid password within the database...

Incorrect Default Permissions

Overview com.liferay.portal:portal-impl is a Portal Impl Affected versions of this package are vulnerable to Incorrect Default Permissions due to insecure default settings in the auth.login.prompt.enabled configuration. An attacker can obtain sensitive information such as usernames, site names, a...

PT-2022-25851 · Liferay · Liferay Portal

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.0.0 through 7.4.2 Description: The issue is related to an insecure default in the auth.login.prompt.enabled component, which allows attackers to enumerate usernames, site names, and pages. Recommendations: For Lifera...

Buildbot CRLF Injection

www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain...

GHSA-66X7-2R56-FJ77 Buildbot CRLF Injection

www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain...

Stock Management System 1.0 - 'Categories Name' Persistent Cross-Site Scripting

Exploit Title: Stock Management System 1.0 - Persistent Cross-Site Scripting Categories Name Exploit Author: Adeeb Shah @hyd3sec Date: August 2, 2020 Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/14366/stock-management-system-php.html Version:...

CVE-2020-14408

An issue was discovered in Agentejo Cockpit 0.10.2. Insufficient sanitization of the to parameter in the /auth/login route allows for injection of arbitrary JavaScript code into a web page's content, creating a Reflected XSS attack vector...

CVE-2020-14408

An issue was discovered in Agentejo Cockpit 0.10.2. Insufficient sanitization of the to parameter in the /auth/login route allows for injection of arbitrary JavaScript code into a web page's content, creating a Reflected XSS attack vector...

PT-2020-13992

Name of the Vulnerable Software and Affected Versions Agentejo Cockpit version 0.10.2 Description An issue was discovered that allows for insufficient sanitization of the to parameter in the "/auth/login" API endpoint, enabling the injection of arbitrary JavaScript code into a web page's content...

CVE-2020-14408: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Agentejo Cockpit 0.10.2. Insufficient sanitization of the to parameter in the /auth/login route allows for injection of arbitrary JavaScript code into a web page's content, creating a Reflected XSS attack vector...

CVE-2018-10383

Lantronix SecureLinx Spider SLS 2.2+ devices have XSS in the auth.asp login page...

CVE-2019-7313

www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain...

PYSEC-2019-77

www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain...

CVE-2019-7313

CVE-2019-7313 – Buildbot CRLF Injection : The flaw is in www/resource.py in Buildbot before 1.8.1, allowing CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. Root cause: missing input validation in the redirection code, enabling header manipulation ...

PT-2019-20160

Name of the Vulnerable Software and Affected Versions Buildbot versions prior to 1.8.1 Description The issue affects the Buildbot application, where the www/resource.py component is vulnerable to CRLF injection. This occurs in the Location header of the "/auth/login" and "/auth/logout" API...