2574 matches found
Online Leave Management System 1.0 SQL Injection
Exploit Title: OLMS - PHP by: oretnom23 v1.0 SQL-Injection-Bypass-Authentication in /leavesystem/classes/Login.php. Author: nu11secur1ty Testing and Debugging: nu11secur1ty Date: 08.31.2021 Vendor: https://www.sourcecodester.com/php/14910/online-leave-management-system-php-free-source-code.html...
SES-by-oretnom23 -v1.0-SQL-Injection-bypass-Login
The SES-byoretnom23 -v1.0 is vulnerable in the application /elearning/classes/Login.php which is called from /elearning/dist/js/script.js app. The parameter username from the login form is not protected correctly and there is no security and escaping from malicious payloads. When the user is...
EyouCMS Cross-site Request Forgery Vulnerability
EyouCMS is an open source content management system CMS based on ThinkPHP.EyouCMS suffers from a cross-site request forgery vulnerability, which stems from a cross-site request forgery CSRF vulnerability in EyouCMS 1.3.6. An attacker could use the vulnerability to execute js code by adding an htm...
CVE-2020-20642
Cross Site Request Forgery CSRF vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn...
CVE-2020-20642
Cross Site Request Forgery CSRF vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn...
PT-2021-10519
Name of the Vulnerable Software and Affected Versions: EyouCMS version 1.3.6 Description: A Cross Site Request Forgery CSRF issue exists, allowing an attacker to add an htm page that can execute js code via the login.php endpoint with specific parameters: m=admin, c=Filemanager, a=newfile, and...
CVE-2020-20642: Cross-Site Request Forgery (CSRF)
Cross Site Request Forgery CSRF vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn...
CVE-2020-19669
Cross Site Request Forgery CSRF vulnerability exists in Eyoucms 1.3.6 that can add an admin account via /login.php?m=admin&c=Admin&a=adminadd&lang=cn...
PT-2021-10386
Name of the Vulnerable Software and Affected Versions: Eyoucms version 1.3.6 Description: A Cross Site Request Forgery CSRF issue exists, allowing an attacker to add an admin account via the /login.php?m=admin&c=Admin&a=admin add&lang=cn API endpoint. This can be exploited by manipulating the m, ...
CVE-2020-23148
The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request...
CVE-2020-23148: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request...
Cross site scripting
Cross Site Scripting XSS vulnerability in gnuboard5 =v5.3.2.8 via the url parameter to bbs/login.php...
CVE-2020-18661
Cross Site Scripting XSS vulnerability in gnuboard5 =v5.3.2.8 via the url parameter to bbs/login.php...
CVE-2020-18661: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in gnuboard5 =v5.3.2.8 via the url parameter to bbs/login.php...
MetInfo Cross-Site Scripting Vulnerability (CNVD-2021-49143)
MetInfo is a Content Management System CMS developed using PHP and Mysql. A cross-site scripting vulnerability exists in MetInfo. The vulnerability can be exploited to conduct cross-site scripting attacks via the gourl parameter in login.php...
CVE-2020-22165
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...
CVE-2020-22165: Improper Neutralization of Special Elements used in an SQL Command
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...
Cross site scripting
Cross Site Scripting XSS vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php...