BIT-AIRFLOW-2022-45402 Apache Airflow: Open redirect during login

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's /login endpoint...

CVE-2023-49547

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customersupport/ajax.php?action=login...

CVE-2023-49547

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customersupport/ajax.php?action=login...

Customer Support System 安全漏洞

Customer Support System is a customer support system by oretnom23 Personal Developer that helps a particular business or company to provide customer support after a customer has purchased a product from them. Customer Support System suffers from a SQL injection vulnerability that originates from...

PT-2024-20840 · Unknown · Sourcecodester Employee Management System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Employee Management System version 1.0 Description: The issue allows attackers to execute arbitrary SQL commands through a crafted POST request to the "/emloyee akpoly/Account/login.php" API endpoint. This enables attackers to...

Exploit for Improper Input Validation in Atlassian Confluence_Data_Center

CVE-2023-22515 How does this detection method work? Th...

VulnCheck KEV: CVE-2019-19825

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an "topicurl":"setting/getSanvas" POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can...

CVE-2022-45177

An issue was discovered in LIVEBOX Collaboration vDesk through v031. An Observable Response Discrepancy can occur under the /api/v1/vdeskintegration/user/isenableuser endpoint, the /api/v1/sharedsearch?search=NAME+SURNAME endpoint, and the /login endpoint. The web application provides different...

LIVEBOX Collaboration vDesk Security Vulnerability

LIVEBOX Collaboration vDesk is an application from LIVEBOX, Inc. A security vulnerability exists in LIVEBOX Collaboration vDesk v031 and later versions, which originates in the /api/v1/vdeskintegration/user/isenableuser, /login endpoints that provide different responses to incoming requests,...

PT-2024-20882 · Code Projects · Code-Projects Simple School Managment System

Name of the Vulnerable Software and Affected Versions: Code-projects Simple School Managment System version 1.0 Description: The issue allows authentication bypass via the username and password parameters at the "School/teacher login.php" endpoint. Recommendations: For Code-projects Simple School...

PT-2024-19452 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalcms version 5.0.0 Description: A Cross Site Scripting XSS issue allows attackers to execute arbitrary code by exploiting the username parameter in the "/admin/login" API endpoint. Recommendations: For JFinalcms version 5.0.0, avoid usin...

PT-2024-15642 · Cxbsoft · Cxbsoft Post-Office

Name of the Vulnerable Software and Affected Versions: CXBSoft Post-Office versions up to 1.0 Description: A critical issue has been found in the HTTP POST Request Handler component, specifically in the /apps/login auth.php file. The manipulation of the username login argument leads to SQL...

CVE-2022-40361

Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacker to execute arbitrary code via the language parameter to the /ngs/login endpoint...

CVE-2022-40361

Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacker to execute arbitrary code via the language parameter to the /ngs/login endpoint...

Elite CRM 跨站脚本漏洞

Elite CRM is a customer relationship management system. A cross-site scripting vulnerability exists in Elite CRM v1.2.11, which stems from the application's lack of effective filtering and escaping of user-supplied data, and can be exploited by an attacker to execute arbitrary code via the langua...

CVE-2022-40361

Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacker to execute arbitrary code via the language parameter to the /ngs/login endpoint...

CVE-2022-40361

Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacker to execute arbitrary code via the language parameter to the /ngs/login endpoint...

PT-2024-7994 · Tp Link · Tp-Link Mr200

Name of the Vulnerable Software and Affected Versions: TP-Link MR200 version 210201 Description: The issue is related to a null-pointer-dereference problem in the web administration panel of the TP-Link MR200. This problem occurs on the "/cgi/login" endpoint via the sign, Action, or LoginStatus...

ipa: Invalid CSRF protection

A Cross-site request forgery vulnerability exists in ipa/session/loginpassword in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During...

ipa: Invalid CSRF protection

A Cross-site request forgery vulnerability exists in ipa/session/loginpassword in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During...