PT-2018-14874

Name of the Vulnerable Software and Affected Versions LAOBANCMS version 2.0 Description An issue was discovered that allows SQL Injection via the guanliyuan parameter in the "admin/login.php" endpoint. Recommendations For LAOBANCMS version 2.0, consider restricting access to the guanliyuan...

PT-2018-14877

Name of the Vulnerable Software and Affected Versions LAOBANCMS version 2.0 Description An issue was discovered that allows spoofing of the id and guanliyuan cookies in the /admin/login.php API endpoint. Recommendations For LAOBANCMS version 2.0, as a temporary workaround, consider restricting...

CVE-2018-19221: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in LAOBANCMS 2.0. It allows SQL Injection via the admin/login.php guanliyuan parameter...

CVE-2018-19224: Reliance on Cookies without Validation and Integrity Checking

An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies...

Sql injection

PhpTpoint hospital management system suffers from multiple SQL injection vulnerabilities via the index.php user parameter associated with LOGIN.php, or the rno parameter to ALIST.php, DUNDEL.php, PDEL.php, or PUNDEL.php...

CVE-2018-18705

PhpTpoint Hospital Management System (PHP) contains multiple SQL injection vulnerabilities reachable via index.php (user parameter in LOGIN.php) and via rno parameters to ALIST.php, DUNDEL.php, PDEL.php, or PUNDEL.php. Exploitation could allow bypassing login to obtain database information or exe...

PT-2018-14583

Name of the Vulnerable Software and Affected Versions PhpTpoint hospital management system affected versions not specified Description The issue concerns SQL injection vulnerabilities. These vulnerabilities can be exploited via the user parameter in index.php associated with LOGIN.php, or the rno...

CVE-2018-18705: Improper Neutralization of Special Elements used in an SQL Command

PhpTpoint hospital management system suffers from multiple SQL injection vulnerabilities via the index.php user parameter associated with LOGIN.php, or the rno parameter to ALIST.php, DUNDEL.php, PDEL.php, or PUNDEL.php...

PT-2018-14454

Name of the Vulnerable Software and Affected Versions s-cms version 3.0 Description The issue allows for SQL Injection, which can be exploited via the "0 id" parameter in the "member/post.php" endpoint or through the POST data sent to the "member/member login.php" endpoint. Recommendations For...

CVE-2018-17866: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field...

CVE-2018-17552

SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie...

PT-2018-14051

Name of the Vulnerable Software and Affected Versions Naviwebs Navigate CMS version 2.8 Description The issue allows remote attackers to bypass authentication. This is achieved via the navigate-user cookie in the login.php file. Recommendations For Naviwebs Navigate CMS version 2.8, update the...

CVE-2018-17552: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie...

btucson.com XSS vulnerability

Open Bug Bounty ID: OBB-680711 Description| Value ---|--- Affected Website:| btucson.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

dus-rohr.de XSS vulnerability

Open Bug Bounty ID: OBB-672726 Description| Value ---|--- Affected Website:| dus-rohr.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

media-products.de XSS vulnerability

Open Bug Bounty ID: OBB-669897 Description| Value ---|--- Affected Website:| media-products.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

pro-auto.ro XSS vulnerability

Open Bug Bounty ID: OBB-655837 Description| Value ---|--- Affected Website:| pro-auto.ro Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

paratuberculosis.net XSS vulnerability

Open Bug Bounty ID: OBB-643892 Description| Value ---|--- Affected Website:| paratuberculosis.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

obitron.de XSS vulnerability

Open Bug Bounty ID: OBB-636699 Description| Value ---|--- Affected Website:| obitron.de Open Bug Bounty Program:| View Open Bug Bounty Program Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:...

manttus.com XSS vulnerability

Open Bug Bounty ID: OBB-635414 Description| Value ---|--- Affected Website:| manttus.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...