Cross site scripting

Cross-site scripting XSS vulnerability in phpPgAdmin 3.5 to 4.1.1, and possibly 4.1.2, allows remote attackers to inject arbitrary web script or HTML via certain input available in PHPSELF in 1 redirect.php, possibly related to 2 login.php, different vectors than CVE-2007-2865...

CVE-2003-1466

CVE-2003-1466 affects Phorum 3.4–3.4.2. Unspecified vulnerability allows remote attackers to use Phorum as a proxy to other sites via (1) register.php or (2) login.php, enabling potential abuse of the application as a gateway to external hosts. The provided documents do not include concrete explo...

CVE-2003-1401

login.php in php-Board 1.0 stores plaintext passwords in $username.txt with insufficient access control under the web document root, which allows remote attackers to obtain sensitive information via a direct request...

CVE-2007-5579

Pligg CMS 9.5 is affected by CVE-2007-5579 through login.php, where a guessable confirmation code enables password reset by an attacker knowing a username. The root cause is a predictable confirmationcode parameter used during forgotten-password flow, allowing an unauthorized password reset with ...

Default credentials

Stride 1.0 has a default administrator username of "scott" with the password "running", which allows remote attackers to obtain administrative access through login.php...

FrontAccounting 1.13 Remote File Inclusion Vulnerabilities

Exploit for unknown platform in category web applications ========================================================== FrontAccounting 1.13 Remote File Inclusion Vulnerabilities ========================================================== ?????????? ??????????????? ???????????????????...

Sql injection

Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via 1 the pseudo parameter to login.php, 2 the id parameter to index.php in a carnet editer action in the MemberSpace espacemembre module, or 3 the typenav parameter to index.php in a...

CVE-2007-4956

Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via 1 the pseudo parameter to login.php, 2 the id parameter to index.php in a carnet editer action in the MemberSpace espacemembre module, or 3 the typenav parameter to index.php in a...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in phpFFL 1.24 allow remote attackers to execute arbitrary PHP code via a URL in the PHPFFLFILEROOT parameter to 1 admin.php, 2 custompages.php, 3 draft.php, 4 faq.php, 5 leagues.php, 6 livedraft.php, 7 login.php, 8 myteam.php, 9 profile.php, 10...

KwsPHP 1.0 - login.php SQL Injection

KwsPHP 1.0 - login.php SQL Injection Script..........................: KwsPHP ver 1.0 Script Site..................: http://kws.koogar.org/ Vulnerability...............: login.php Remote SQL injection Exploit Access.........................: Remote level.............................: Dangerous...

KwsPHP 1.0 - 'login.php' SQL Injection

Script..........................: KwsPHP ver 1.0 Script Site..................: http://kws.koogar.org/ Vulnerability...............: login.php Remote SQL injection Exploit Access.........................: Remote level.............................: Dangerous Author..........................: S4mi...

CRS Manager ($DOCUMENT_ROOT) Multi Remote File Include

X---- w w w . u N k n 0 w n . e u ----X CRS Managercrsmanager Multi Remote File Include ::Home: http://crsmanager.berlios.de ::Vuln Type : Remote File Include RFI ::Discovered by : iNs ::Vuln Code: index.php login.php ?php require $DOCUMENTROOT."/../admin/settings/conf.php"; PoC:...

Remote file inclusion

PHP remote file inclusion vulnerability in login.php in MyREFERER 1.08 allows remote attackers to execute arbitrary PHP code via a URL in the value parameter...

CVE-2007-4484

CVE-2007-4484 describes a PHP remote file inclusion vulnerability in My_REFERER 1.08, specifically in login.php where an attacker can cause arbitrary PHP code execution by supplying a URL in the value parameter. The public description confirms the vulnerable component (login.php) and the vulnerab...

My_REFERER v.1.08 Remote File Include

App Name : MyREFERER v.1.08 HomePage : http://www.phoenix.frihost.net/referer/readme.php Vuln type : Remote File Include RFI Vulnerability Discovered by : iNs Vuln Code: login.php include"$value"; POC: htttp://site.com/path/login.php?value=SHELL.txt?? iNs @ uNkn0wn.eu Gr33tz t0: uNkn0wn.eu - iD -...

mcLinksCounter 1.2 Remote File Include by iNs

App Name : mcLinksCounter 1.2 HomePage: http://www.phpforums.net Vuln type : Remote File Include RFI Vuln Discovered by : iNs BUG: on file stats.php ,login.php ,detail.php : include "$langfile"; PoC: http://www.site.com/path/stats.php?langfile=sH3lLz? iNs @ uNkn0wn.eu Gr33tz t0: uNkn0wn.eu - iD -...

CVE-2007-4307

Storesprite 7 and earlier suffer multiple XSS vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via the next parameter to addaddress.php, editshipdetails.php, register.php, or login.php in the secure/ path. The affected component is the web application Storesprite...

PhpHostBot Login.PHP远程文件包含漏洞

PhpHostBot是一款基于PHP的WEB应用程序。 PhpHostBot不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以应用程序进程权限执行任意命令。 问题是由于'Login.PHP'脚本对用户提交的'svrrootscript'参数缺少过滤，提交远程服务器上的任意PHP文件作为包含对象，可导致以WEB权限执行任意PHP代码。 PhpHostBot 1.06 目前没有解决方案提供： http://www.idevspot.com/PhpHostBot.php...

Unfixed XSS vulnerability at www.eetechbrief.com

Security researcher Narcoticxs, has submitted on 08/08/2007 a cross-site-scripting XSS vulnerability affecting www.eetechbrief.com, which at the time of submission ranked 8475386 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/08/2007. It is...

CVE-2007-4021

Multiple cross-site scripting XSS vulnerabilities in login.php in Brain Book Software Secure 1.0.20070629 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 user and 2 pwd parameters...