10 matches found
CVE-2025-5928: Cross-Site Request Forgery (CSRF)
The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wpslidingpaneluseroptions function. This makes it possible for unauthenticated attackers t...
TP-Link Login Dashboard SQL Injection
The vulnerability of the Login Dashboard component of TP-Link’s microprogramming router TL-WR840N relates to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by introducing specially crafted SQL code...
CVE-2025-29648
SQL Injection vulnerability exists in the TP-Link EAP120 router s login dashboard version 1.0, allowing an unauthenticated attacker to inject malicious SQL statements via the login fields. NOTE: this is disputed because the issue can only be reproduced on a supplier-provided emulator, where acces...
CVE-2025-29649
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...
PT-2025-16881
Name of the Vulnerable Software and Affected Versions TP-Link TL-WR840N router version 1.0 Description A SQL Injection vulnerability exists in the TP-Link TL-WR840N router's login dashboard, allowing an unauthenticated attacker to inject malicious SQL statements via the username and password...
PT-2025-16880
Name of the Vulnerable Software and Affected Versions TP-Link EAP120 router version 1.0 Description A SQL Injection vulnerability exists in the TP-Link EAP120 router's login dashboard, allowing an unauthenticated attacker to inject malicious SQL statements via the login fields. Note that this iss...
CVE-2022-0385: Improper Neutralization of Input During Web Page Generation
The Crazy Bone WordPress plugin through 0.6.0 does not sanitise and escape the username submitted via the login from when displaying them back in the log dashboard, leading to an unauthenticated Stored Cross-Site scripting...
Crazy Bone <= 0.6.0 - Unauthenticated Stored XSS
The plugin does not sanitise and escape the username submitted via the login from when displaying them back in the log dashboard, leading to an unauthenticated Stored Cross-Site scripting PoC curl 'https://example.com/wp-login.php' --data-raw 'log=a=x&wp-submit;=Log+In' The XSS will be trigged in...