CVE-2020-13167

Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php with certain Referer headers launches a command line with client-supplied parameters, and allows injection of shell metacharacters...

CVE-2019-19484

Open redirect via parameter ‘p’ in login.php in Centreon 19.04.4 and below allows an attacker to craft a payload and execute unintended behavior...

PT-2019-6424 · Ruijie · Ruijie Eg-2000 Series Gateway

Name of the Vulnerable Software and Affected Versions: Ruijie EG-2000 series gateway versions EG-2000SE EG RGOS 11.11B1. Description: The issue is related to a buffer overflow in the client.so file of the Ruijie EG-2000 series gateway. This allows an attacker to login to any account without...

CVE-2019-16057

The loginmgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection...

CVE-2017-6900

An issue was discovered in Riello NetMan 204 14-2 and 15-2. The issue is with the login script and wrongpass Python script used for authentication. When calling wrongpass, the variables $VAL0 and $VAL1 should be enclosed in quotes to prevent the potential for Bash command injection. Further to...

CVE-2018-6320

A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure PCS 8.1RX before 8.1R12 and 8.3RX before 8.3R2 and Pulse Policy Secure PPS 5.2RX before 5.2R9 and 5.4RX before 5.4R2 wherein an https Host header received from the browser is trusted without validation...

PT-2018-3857 · Mitsubishi · Mitsubishi Electric Smartrtu

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric SmartRTU affected versions not specified Description: The issue is related to the lack of protection for the web page structure in Mitsubishi Electric SmartRTU, allowing an attacker to conduct cross-site scripting attacks...

VulnCheck KEV: CVE-2016-20017

D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter...

CVE-2018-9161

Prisma Industriale Checkweigher PrismaWEB 1.21 allows remote attackers to discover the hardcoded prisma password for the prismaweb account by reading user/scripts/loginpar.js...

D-Link DIR-615 Wireless N 300 Router Authentication Bypass Vulnerability

The D-Link DIR-615 Wireless N 300 is a wireless router product from AUO D-Link. A security vulnerability exists in the D-Link DIR-615 Wireless N 300 router that stems from the program not validating the password field. An attacker can bypass authentication by sending a modified POST request to th...

Xavier 2.4 SQL Injection

Document Title: =============== Xavier v2.4 PHP MP - SQL Injection Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2076 Release Date: ============= 2017-06-06 Vulnerability Laboratory ID VL-ID: ==================================== 20...

CVE-2016-10329

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...

CVE-2016-3109

The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code...

SQL Injection Vulnerability in Shield Spirit Public Number Promotion System Login.php

Shield Spirit public number promotion system is mainly applied to public number promotion affiliate. A SQL injection vulnerability exists in the login.php of the Shield Spirit public number promotion system. Since the username variable in the statement gets data directly from post, it allows...

ZKTeco ZKBioSecurity 3.0 Local Privilege Bypass Vulnerability

ZKBioSecurity is a comprehensive management platform for biometric security. A local privilege bypass vulnerability exists in ZKTeco ZKBioSecurity 3.0, which is caused by the visLogin.jsp script processing login requests via the 'EnvironmentUtil.getClientIprequest' method, allowing an attacker to...

ZKTeco ZKBioSecurity 3.0 User Enumeration

!/usr/bin/env python ZKTeco ZKBioSecurity 3.0 User Enumeration Weakness Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd Product web page: http://www.zkteco.com Affected version: 3.0.1.0R230 Platform: 3.0.1.0R230 Personnel: 1.0.1.0R1916 Access: 6.0.1.0R1757 Elevator...

CVE-2016-5639

Directory traversal vulnerability in cgi-bin/login.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to read arbitrary files via a .. dot dot in the src parameter...

Mango Automation 2.6.0 User Enumeration

Mango Automation 2.6.0 User Enumeration Weakness Vendor: Infinite Automation Systems Inc. Product web page: http://www.infiniteautomation.com Affected version: 2.5.2 and 2.6.0 beta build 327 Summary: Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to...

KnowledgeTree 'login.php' Cross-Site Scripting Vulnerability

KnowledgeTree is a Web-based open source document management system . A cross-site scripting vulnerability exists in KnowledgeTree login.php, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or...

Hotspot Express hotEx Billing Manager cgi-bin/hotspotlogin.cgi Cross-Site Scripting Vulnerability

Hotspot Express hotEx Billing Manager is a billing management system. A cross-site scripting vulnerability in Hotspot Express hotEx Billing Manager cgi-bin/hotspotlogin.cgi allows attackers to submit special reply parameters to inject malicious HTML or scripts and obtain sensitive information...