CVE-2014-9519: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in InfiniteWP Admin Panel before 2.4.3 allows remote attackers to execute arbitrary SQL commands via the email parameter...

myinobas.de XSS vulnerability

Open Bug Bounty ID: OBB-53070 Description| Value ---|--- Affected Website:| myinobas.de Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

CVE-2014-9039

wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message...

CVE-2014-9033

CVE-2014-9033 is a CSRF vulnerability in WordPress affecting wp-login.php that could allow an attacker to hijack a user’s authentication by tricking them into performing a password change. The advisory data lists affected WordPress versions as 3.7.4, 3.8.4, 3.9.2, and 4.0, with remediation indica...

CVE-2014-9033

Cross-site request forgery CSRF vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords...

CVE-2014-9039

CVE-2014-9039 affects WordPress versions prior to 4.0.1 for the 4.x line and older 3.x branches: remote password resets could be triggered if an attacker gains access to the email account that received the reset message. The explicit vulnerable ranges are WordPress before 3.7.5, 3.8.x before 3.8....

CVE-2014-9039

wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message...

CVE-2014-9033: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords...

CVE-2014-9039: Undefined Security Weakness

wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message...

PT-2014-8809

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.7.5 WordPress versions 3.8.x prior to 3.8.5 WordPress versions 3.9.x prior to 3.9.3 WordPress versions 4.x prior to 4.0.1 Description The issue allows remote attackers to reset passwords by leveraging access to an...

PT-2014-8803

Name of the Vulnerable Software and Affected Versions WordPress versions 3.7.4, 3.8.4, 3.9.2, and 4.0 Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack the authentication of arbitrary users for requests that reset passwords. This occurs in the...

WordPress <= 4.0.0 - CSRF

Because of this vulnerability in wp-login.php, the attackers can hijack the authentication of arbitrary users for requests that reset passwords. Solution Update WordPress...

WordPress <= 4.0.0 - Multiple Vulnerabilities #1

There are multiple vulnerabilities in WordPress wp-login.php, such as cross site scripting, denial of service attacks, hash comparison, SSRF, CSRF. Because of these vulnerabilities, attackers can reset passwords by leveraging access to an e-mail account that received a password-reset message...

Sql injection

SQL injection vulnerability in login.php in MegaLab The Uploader before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2011-2944

CVE-2011-2944 affects MegaLab The Uploader prior to version 2.0.5. The login.php handling allows a SQL injection via the username parameter, enabling remote attackers to execute arbitrary SQL commands. The NVD record lists a CVSS v2 base score of 7.5 (HIGH) with network access, low attack complex...

CVE-2011-2944: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in MegaLab The Uploader before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter...

PT-2014-2134

Name of the Vulnerable Software and Affected Versions MegaLab The Uploader versions prior to 2.0.5 Description The issue allows remote attackers to execute arbitrary SQL commands via the username parameter in the login.php file. Recommendations For versions prior to 2.0.5, update to version 2.0.5...

Cross site scripting

Cross-site scripting XSS vulnerability in Status2k allows remote attackers to inject arbitrary web script or HTML via the username to login.php...

CVE-2014-5088

CVE-2014-5088 is a cross-site scripting (XSS) vulnerability in Status2k Server Monitoring Software. The risk entry describes an attacker injecting arbitrary script/HTML through the username parameter sent to login.php, enabling remote exploitation. Public records in the NVD entry enumerate the fl...

CVE-2014-5088: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Status2k allows remote attackers to inject arbitrary web script or HTML via the username to login.php...