2574 matches found
Sql injection
FlameCMS 3.3.5 has SQL injection in account/login.php via accountName...
CVE-2019-16309
FlameCMS 3.3.5 has an SQL injection in account/login.php via the accountName parameter. The root cause is a lack of input validation for SQL statements in a database-backed application, enabling an attacker to execute arbitrary SQL commands. This CVE (CVE-2019-16309) is corroborated by multiple s...
CVE-2019-16309: Improper Neutralization of Special Elements used in an SQL Command
FlameCMS 3.3.5 has SQL injection in account/login.php via accountName...
PT-2019-14618
Name of the Vulnerable Software and Affected Versions FlameCMS version 3.3.5 Description The issue concerns SQL injection in the account/login.php file via the accountName variable. Recommendations For FlameCMS version 3.3.5, update to a version that fixes the SQL injection issue in...
CVE-2019-15826
The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field...
CVE-2019-15826
The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field...
CVE-2019-15826: Undefined Security Weakness
The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field...
PT-2019-14415
Name of the Vulnerable Software and Affected Versions wps-hide-login plugin versions prior to 1.5.3 Description The issue allows for protection bypass via the "wp-login.php" page, specifically through manipulation of the Referer field. Recommendations For versions prior to 1.5.3, update to versio...
PT-2019-11542 · Timesheet · Timesheet Next Gen
Name of the Vulnerable Software and Affected Versions: Timesheet Next Gen versions 1.5.3 and earlier Description: The issue allows an attacker to execute arbitrary HTML and JavaScript code via a redirect parameter. This is a reflected Cross Site Scripting XSS attack, where the victim may click on...
CVE-2019-1010287: Improper Neutralization of Input During Web Page Generation
Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may...
Sql injection
DISPUTED Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass aka the reset password form. NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid...
CVE-2019-12279
Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass aka the reset password form. NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that...
CVE-2019-12279: Improper Neutralization of Special Elements used in an SQL Command
Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass aka the reset password form. NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that...
Sql injection
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=SQL, index.php?p=rooms&q=SQL, or admin/login.php...
CVE-2018-18800
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=SQL, index.php?p=rooms&q=SQL, or admin/login.php...
PT-2019-9632
Name of the Vulnerable Software and Affected Versions Tubigan "Welcome to our Resort" version 1.0 Description The issue allows SQL Injection, which can be exploited through specific API endpoints, such as "index.php?p=accomodation&q=SQL", "index.php?p=rooms&q=SQL", or "admin/login.php"...
CVE-2018-18800: Improper Neutralization of Special Elements used in an SQL Command
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=SQL, index.php?p=rooms&q=SQL, or admin/login.php...
SOCA Access Control System 180612 - SQL Injection
SOCA Access Control System 180612 SQL Injection And Authentication Bypass Vendor: SOCA Technology Co., Ltd Product web page: http://www.socatech.com Affected version: 180612, 170000 and 141007 Summary: The company's products include proximity and fingerprint access control system, time and...