PT-2019-9384

Name of the Vulnerable Software and Affected Versions Open XDMoD versions prior to 7.5.0 Description An issue was discovered in Open XDMoD, where the html/gui/general/login.php endpoint has a Reflected XSS vulnerability via the xd user formal name parameter. Recommendations For Open XDMoD version...

CVE-2018-16960: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open XDMoD through 7.5.0. html/gui/general/login.php has Reflected XSS via the xduserformalname parameter...

CVE-2019-7660: Improper Neutralization of Input During Web Page Generation

An issue was discovered in PHPMyWind 5.5. The username parameter of the /install/index.php page has a stored Cross-site Scripting XSS vulnerability, as demonstrated by admin/login.php...

WordPress Cerber Security Antispam & Malware Scan 8.0 Plugin - Multiple Bypass Vulnerabilities

Exploit for php platform in category web applications Exploit Title: WordPress Cerber Security, Antispam & Malware Scan - Multiple Bypass Vulnerabilities Type: WordPress Plugin Active installs: 100,000+ Version: 8.0 Software Link: https://wordpress.org/plugins/wp-cerber/ Exploit Author: ed0x21son...

PT-2019-19008

Name of the Vulnerable Software and Affected Versions Hotels Server versions prior to 2018-11-05 Description The issue is related to SQL Injection, which occurs due to the mishandling of the telephone parameter in the "controller/api/login.php" API endpoint. This allows for potential exploitation...

CVE-2019-8393: Improper Neutralization of Special Elements used in an SQL Command

HotelsServer through 2018-11-05 has SQL Injection via the API because the controller/api/login.php telephone parameter is mishandled...

CVE-2018-19414: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to inject arbitrary web script or HTML via the 1 keyword parameter to groups.php; 2 username parameter to login.php; or 3 date parameter to search.php...

PT-2019-9804

Name of the Vulnerable Software and Affected Versions Plikli CMS version 4.0.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters in various PHP files. The...

PT-2018-9590

Name of the Vulnerable Software and Affected Versions: WeBid versions up to 1.2.2 Description: The issue allows for Javascript execution in the user's browser and injection of malicious markup into the page due to a Cross Site Scripting XSS vulnerability in files such as user login.php and...

Design/Logic Flaw

login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field...

CVE-2018-19877

login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field...

CVE-2018-19877

login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field...

CVE-2018-19877

CVE-2018-19877 affects Adiscon LogAnalyzer prior to 4.1.7. The vulnerability is a Cross-Site Scripting (XSS) in the login.php file, exploitable via the Login Button Referer field. The underlying issue is an XSS in the referer parameter of login.php, allowing execution of malicious scripts in the ...

PT-2018-15135

Name of the Vulnerable Software and Affected Versions Adiscon LogAnalyzer versions prior to 4.1.7 Description The issue concerns a problem with the login functionality. Specifically, it involves the Login Button Referer field in the login.php file, which is vulnerable to XSS attacks...

CVE-2018-19877: Improper Neutralization of Input During Web Page Generation

login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field...

dappbuilder.io XSS vulnerability

Open Bug Bounty ID: OBB-702970 Description| Value ---|--- Affected Website:| dappbuilder.io Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Simple E-Document 1.31 - username SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Simple E-Document 1.31 - 'username' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: http://www.tecorange.com/index.php/download-free-open-source-software/79-simple-e-document-free-open-source-document-and-paper-m...

BitZoom 1.0 - rollno SQL Injection

BitZoom 1.0 - rollno SQL Injection Exploit Title: BitZoom 1.0 - 'rollno' SQL Injection Dork: N/A Date: 2018-11-14 Exploit Author: Ihsan Sencan Vendor Homepage: https://bitzoom.sourceforge.io/ Software Link: https://excellmedia.dl.sourceforge.net/project/bitzoom/bitzoom-master.zip Version: 1.0...

CVE-2018-19224

An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies...

CVE-2018-19221

CVE-2018-19221 affects LAOBANCMS 2.0. The vulnerability is a SQL injection via the admin/login.php guanliyuan parameter, as described across multiple connected sources. CVSS metrics from the initial document show an overall high/critical impact (CVSS2: 7.5; CVSS3: 9.8) with network access, no aut...