CVE-2022-45214

A cross-site scripting XSS vulnerability in Sanitization Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter at /php-sms/classes/Login.php...

Sanitization Management System 跨站脚本漏洞

Sanitization Management System is a sanitization management system by Carlo Montero Personal Developer. A security vulnerability exists in Sanitization Management System version v1.0.0. An attacker can exploit this vulnerability to execute arbitrary web script or HTML by injecting a specially...

Online Driving School SQL注入漏洞

Online Driving School is an online driving school program by the individual developers at Codeprojects. Online Driving School suffers from a SQL injection vulnerability that originates in an unknown section of login.php, where manipulation of the parameters username and password can result in a s...

CVE-2022-36581

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via the useremail parameter at /admin/login.php...

CVE-2022-37153

An issue was discovered in Artica Proxy 4.30.000000. There is a XSS vulnerability via the password parameter in /fw.login.php...

CVE-2022-33119

NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting XSS vulnerability via login.php...

CVE-2021-43510

SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the username field in login.php...

CVE-2021-40595

SQL injection vulnerability in Sourcecodester Online Leave Management System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username parameter to /leavesystem/classes/Login.php...

CVE-2021-25898

An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Passwords are stored in unencrypted source-code text files. This was noted when accessing the svc-login.php file. The value is used to authenticate a high-privileged user upon authenticating with the server...

Online Internship Management System 1.0 SQL Injection

Exploit Title: Online Internship Management System 1.0 - 'email' SQL injection Auth Bypass Date: 16-02-2021 Exploit Author: Christian Vierschilling Vendor Homepage: https://www.sourcecodester.com Software Link:...

CVE-2020-14973

The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting XSS vulnerability via the query string...

Synology Photo Station Security Bypass Vulnerability

Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. A security bypass vulnerability exists in Synology Photo Station versions prior to 6.3-2958. The vulnerability can be exploited by a remote attacker to execute arbitrary commands by sending an...

Remote Command Execution Vulnerability in iGuardian Security Guardian

iGuardian is a router-based application embedded in the Linux operating system, with Snort an intrusion detection system as an embedded command-and-control system. A remote command execution vulnerability exists in the iGuardian Security/apps/login.php file. This allows an attacker to remotely...

photocart-sql.txt

Author: !DoktOR! Date found: 18.08.08 Product: PhotoCart Version: 3.9 возможно и более ранние версии Type: Photography Shopping Cart URL: www.picturespro.com Vulnerability Class: SQL Injection /installdir/search.php Vuln code: PHP: if$REQUEST'searchby' == "qtitle" $galwhere'where' = "WHERE...

FlaP 1.0b - 'pachtofile' Remote File Inclusion

FlaP v.1.0. Beta = Remote File Inclusion Vulnerability Vuln Code ERROR1:skin/html/table.php ? include "$pachtofile/leftmenu.php"; RFI CODE BUG1: Example1:http://victim.com/path/skin/html/table.php?pachtofile=Sh3LL Script...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in GPL PHP Board GPB unstable-2001.11.14-1 allow remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter to 1 db.mysql.inc.php or 2 gpb.inc.php in include/, or the 3 theme parameter to themes/ubb/login.php...

Invision Power Board <= 1.3.1 Login.PHP SQL Injection (working)

No description provided by source. ?php / = 1.3.1 Final /str0ke / $server = "SERVER"; $port = 80; $file = "PATH"; $target = 81; / User id and password used to fake-logon are not important. '10' is a random number. / $id = 10; $pass = ""; $hex = "0123456789abcdef"; for$i = 1; $i = 32; $i++ $idx = ...