CVE-2026-108109

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otpcode. Attackers knowing a customer username can guess the code without attempt limits or...

CVE-2026-108109

PHPNuxBill versions through 2025.3.20 are vulnerable to an account takeover due to a flaw in the customer password reset flow within system/controllers/forgot.php. The vulnerability allows unauthenticated attackers who know a customer's username to brute-force a 6-digit otp_code because the syste...

CVE-2026-108109 PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otpcode. Attackers knowing a customer username can guess the code without attempt limits or...

EUVD-2026-95810

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otpcode. Attackers knowing a customer username can guess the code without attempt limits or...

CVE-2026-108109 PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otpcode. Attackers knowing a customer username can guess the code without attempt limits or...

CVE-2026-108109: Improper Restriction of Excessive Authentication Attempts

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otpcode. Attackers knowing a customer username can guess the code without attempt limits or...

CVE-2018-25163

BitZoom 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the rollno and username parameters in forgot.php and login.php. Attackers can submit crafted POST requests with SQL UNION statements to...

CVE-2018-25163: Improper Neutralization of Special Elements used in an SQL Command

BitZoom 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the rollno and username parameters in forgot.php and login.php. Attackers can submit crafted POST requests with SQL UNION statements to...

CVE-2024-9327

A vulnerability was found in code-projects Blood Bank System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forgot.php. The manipulation of the argument useremail leads to sql injection. The attack can be initiated remotely. The exploit has been...

CVE-2024-9327 code-projects Blood Bank System forgot.php sql injection

A vulnerability was found in code-projects Blood Bank System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forgot.php. The manipulation of the argument useremail leads to sql injection. The attack can be initiated remotely. The exploit has been...

CVE-2024-9327 code-projects Blood Bank System forgot.php sql injection

A vulnerability was found in code-projects Blood Bank System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forgot.php. The manipulation of the argument useremail leads to sql injection. The attack can be initiated remotely. The exploit has been...

CVE-2024-9327: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in code-projects Blood Bank System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forgot.php. The manipulation of the argument useremail leads to sql injection. The attack can be initiated remotely. The exploit has been...

awi-application.org XSS vulnerability

Open Bug Bounty ID: OBB-698479 Description| Value ---|--- Affected Website:| awi-application.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

BitZoom 1.0 - rollno SQL Injection

BitZoom 1.0 - rollno SQL Injection Exploit Title: BitZoom 1.0 - 'rollno' SQL Injection Dork: N/A Date: 2018-11-14 Exploit Author: Ihsan Sencan Vendor Homepage: https://bitzoom.sourceforge.io/ Software Link: https://excellmedia.dl.sourceforge.net/project/bitzoom/bitzoom-master.zip Version: 1.0...

scisoc.or.th XSS vulnerability

Open Bug Bounty ID: OBB-593353 Description| Value ---|--- Affected Website:| scisoc.or.th Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ma-formation-bafa.fr XSS vulnerability

Open Bug Bounty ID: OBB-592797 Description| Value ---|--- Affected Website:| ma-formation-bafa.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

rechargement.ascanis.fr XSS vulnerability

Open Bug Bounty ID: OBB-592794 Description| Value ---|--- Affected Website:| rechargement.ascanis.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

mainstreameng.co.nz XSS vulnerability

Open Bug Bounty ID: OBB-576896 Description| Value ---|--- Affected Website:| mainstreameng.co.nz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

holbrookemotorcompany.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-572084 Description| Value ---|--- Affected Website:| holbrookemotorcompany.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

portsmouthcardiac.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-572078 Description| Value ---|--- Affected Website:| portsmouthcardiac.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...