CVE-2025-60736

CVE-2025-60736: Online Medicine Guide におけるSQLインジェクションの脆弱性 エグゼクティブサマリー 本書は、Online Medicine Guide Webアプリケーションで発見された重大なSQLインジェクションの脆弱性について概説するものです。この脆弱性により、不正なデータベースアクセスが可能となり、アプリケーションとそのユーザーに重大なセキュリティリスクをもたらします。 提出者 Noah "nxvh" Heraud 1. 製品情報 影響を受ける製品 製品名 : Online Medicine Guide ベンダー : Code Project...

CVE-2025-65881

CVE-2025-65881 프로젝트 Zoo Management System v1.00은 /zms/classes/Login.php?f=login에서 크로스 사이트 스크립팅XSS에 취약합니다. 이유는 다음과 같습니다: 1. /zms/classes/Login.php?f=login에서 JSON 응답의 Content-type이 올바르지 않음 2. 응답 내 사용자 입력이 적절히 처리되지 않음 인증되지 않은 공격자가 피해자 브라우저에서 실행되는 악성 HTML/JS를 주입할 수 있습니다. 영향을 받는 파일 및 취약한 코드...

CVE-2024-8465-PoC

CVE-2024-8465 – SQL 인젝션 개념 증명 팀 정보 팀 이름: The Misfits 팀 구성원: Muhammad Tayyab Nisar Oluwasola SAMUEL Abubakar Mohamed Melek Balghouthi 개요 이 저장소에는 CVE-2024-8465를 모델로 한 SQL 인젝션 취약점을 시연하기 위해 개념 증명PoC으로 제작된 취약한 웹 애플리케이션이 포함되어 있습니다. 이 애플리케이션은 의도적으로 안전하지 않게 설계되었으며, 부적절한 입력 처리로 인해 인증 우회와 데이터베이스 데이터 노출이 어떻...

TheMisfits-CVE-2024-8465-SQLi

CVE-2024-8465 – SQL 인젝션 개념 증명 팀 정보 팀 이름: The Misfits 팀 구성원: Muhammad Tayyab Nisar Oluwasola SAMUEL Abubakar Mohamed Melek Balghouthi 개요 이 저장소에는 CVE-2024-8465를 모델로 한 SQL 인젝션 취약점을 시연하기 위해 개념 증명PoC으로 생성된 취약한 웹 애플리케이션이 포함되어 있습니다. 이 애플리케이션은 의도적으로 안전하지 않으며, 부적절한 입력 처리가 인증 우회 및 데이터베이스 데이터 노출로 이어질 수 있는 방...

CVE-2025-47227

CVE-2025-47227 CVE-2025-47227 のエクスプロイト - ScriptCase パスワードリセット（事前認証） CVE-2025-47227 は、ScriptCase Production Environment ≤ 9.12.006 における 事前認証 の認証バイパス（CVSS 9.8）です。login.php エンドポイントは、トークン、メール検証、認証を必要とせずに管理者パスワードのリセットを許可します。必要なのは、4文字のCAPTCHA（簡単に解ける）と nmaction=changepass を送信するPOSTのみです。 CVE-2025-47228...

CVE-2026-96773

A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $SERVER'HTTPREFERER' causes open redirect. The attack is possible to be...

CVE-2026-96773 Intelliants Subrion CMS Login Page login.php authorize redirect

A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $SERVER'HTTPREFERER' causes open redirect. The attack is possible to be...

CVE-2026-96773

A vulnerability exists in Intelliants Subrion CMS versions up to 4.2.1 . The flaw resides in the iaUsers::authorize function within the front/login.php file of the Login Page component. By manipulating the $_SERVER['HTTP_REFERER'] argument, a remote attacker can trigger an open redirect . Public ...

EUVD-2026-85760

A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $SERVER'HTTPREFERER' causes open redirect. The attack is possible to be...

CVE-2026-96773 Intelliants Subrion CMS Login Page login.php authorize redirect

A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $SERVER'HTTPREFERER' causes open redirect. The attack is possible to be...

CVE-2026-96773: URL Redirection to Untrusted Site

A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $SERVER'HTTPREFERER' causes open redirect. The attack is possible to be...

PT-2026-97644

Name of the Vulnerable Software and Affected Versions Intelliants Subrion CMS versions prior to 4.2.2 Description A weakness in the Login Page component allows for a remote open redirect. This occurs through the manipulation of the $ SERVER'HTTP REFERER' variable within the iaUsers::authorize...

CVE-2026-19125 EthPress <= 2.3.5 - Unauthenticated Authentication Bypass

The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verifylogin function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2...

CVE-2026-93368

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-93368 Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-93368 Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

EUVD-2026-85169

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-93368

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to a time-based SQL Injection in all versions up to and including 2.0.1 . The root cause is insufficient escaping and a lack of sufficient preparation on the existing SQL query for the 'log' (Username) parameter. Beca...

WordPress Rename wp-login.php to anything you want plugin <= 2.0.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by nthng in WordPress Plugin Rename wp-login.php to anything you want versions = 2.0.1...

EUVD-2026-84949

A vulnerability has been found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this vulnerability is an unknown functionality of the file login.php. Such manipulation of the argument user/pass leads to sql injection. The attack may be performed...