Missing Critical Step in Authentication

Overview Affected versions of this package are vulnerable to Missing Critical Step in Authentication via the authenticateUser method in ShiroSecurityProcessor in the Shiro component. An attacker can access Shiro-protected routes as an authenticated user by sending an exchange that names a princip...

PYSEC-2026-640 SQL Injection in FreeTAKServer-UI

FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser...

EUVD-2014-9271

Malware in sbrugna...

CVE-2025-10599

The CVE-2025-10599 affects itsourcecode Web-Based Internet Laboratory Management System 1.0. The vulnerability is a SQL injection in User::AuthenticateUser within login.php triggered by manipulating the user_email parameter. Multiple connected sources confirm the issue and its public exploitation...

CVE-2025-10599: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in itsourcecode Web-Based Internet Laboratory Management System 1.0. Impacted is the function User::AuthenticateUser of the file login.php. Performing manipulation of the argument useremail results in sql injection. Remote exploitation of the attack is possible...

GHSA-JR2M-29WJ-W9QC SQL Injection in FreeTAKServer-UI

FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser...

CVE-2022-25506

FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser...

CVE-2022-25506

FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser...

Sql injection

FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser...

CVE-2022-25506

CVE-2022-25506 concerns FreeTAKServer-UI v1.9.8 with a reported SQL injection vulnerability in the API endpoint /AuthenticateUser . Multiple connected sources confirm the flaw stems from improper neutralization of SQL commands against the SQLite3 database, enabling an attacker to access sensitive...

CVE-2022-25506

FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser...

PT-2022-17336

Name of the Vulnerable Software and Affected Versions FreeTAKServer-UI version 1.9.8 Description The issue is a SQL injection vulnerability that can be exploited via the API endpoint /AuthenticateUser. This allows an attacker to inject malicious SQL code, potentially leading to unauthorized acces...

CVE-2022-25506: Improper Neutralization of Special Elements used in an SQL Command

FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser...

CVE-2014-9451

Multiple stack-based buffer overflows in the DIVA web service API /webservice in VDG Security SENSE formerly DIVA 2.3.13 allow remote attackers to execute arbitrary code via the 1 user or 2 password parameter in an AuthenticateUser request...

Stack overflow

Multiple stack-based buffer overflows in the DIVA web service API /webservice in VDG Security SENSE formerly DIVA 2.3.13 allow remote attackers to execute arbitrary code via the 1 user or 2 password parameter in an AuthenticateUser request...

CVE-2014-9451

Multiple stack-based buffer overflows in the DIVA web service API /webservice in VDG Security SENSE formerly DIVA 2.3.13 allow remote attackers to execute arbitrary code via the 1 user or 2 password parameter in an AuthenticateUser request...

CVE-2014-9451: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple stack-based buffer overflows in the DIVA web service API /webservice in VDG Security SENSE formerly DIVA 2.3.13 allow remote attackers to execute arbitrary code via the 1 user or 2 password parameter in an AuthenticateUser request...

PT-2015-4214

Name of the Vulnerable Software and Affected Versions VDG Security SENSE version 2.3.13 Description The issue concerns multiple stack-based buffer overflows in the DIVA web service API, specifically at the "/webservice" endpoint. This allows remote attackers to execute arbitrary code by...

CVE-2008-6911: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the authenticateUser function in includes/authentication.inc.php in BrewBlogger BB 2.1.0.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the loginUsername parameter to includes/logincheck.inc.php. NOTE: some of these...