PT-2021-10638

Name of the Vulnerable Software and Affected Versions: MetInfo version 7.0.0 Description: A Cross Site Scripting XSS issue exists via the gourl parameter in the "login.php" endpoint. Recommendations: For MetInfo version 7.0.0, update the software to a version that fixes this issue, or as a...

CVE-2020-29214: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in SourceCodester Alumni Management System 1.0 allows the user to inject SQL payload to bypass the authentication via admin/login.php...

PT-2021-11658

Name of the Vulnerable Software and Affected Versions: SourceCodester Alumni Management System version 1.0 Description: The issue allows a user to inject SQL payload to bypass authentication via the "admin/login.php" endpoint. This can potentially lead to unauthorized access. Recommendations: For...

CVE-2021-31738

Adiscon LogAnalyzer 4.1.10 and 4.1.11 allow login.php XSS...

CVE-2021-31738

Adiscon LogAnalyzer 4.1.10 and 4.1.11 allow login.php XSS...

Adiscon LogAnalyzer Cross-Site Script Vulnerability

Adiscon LogAnalyzer is a set of web front-end tools for system logs and other network event data. The tool provides log browsing, search and basic analysis, and graphical display. A security vulnerability exists in Adiscon LogAnalyzer 4.1.10 and 4.1.11 that allows login.php to execute XSS...

CVE-2021-31738: Improper Neutralization of Input During Web Page Generation

Adiscon LogAnalyzer 4.1.10 and 4.1.11 allow login.php XSS...

PT-2021-19486

Name of the Vulnerable Software and Affected Versions Adiscon LogAnalyzer versions 4.1.10 through 4.1.11 Description The issue allows for XSS in the login.php file. Recommendations For versions 4.1.10 and 4.1.11, consider disabling access to the login.php file until a fix is available...

CVE-2021-30083

An issue was discovered in Mediat 1.4.1. There is a Reflected XSS vulnerability which allows remote attackers to inject arbitrary web script or HTML without authentication via the 'return' parameter in login.php...

CVE-2021-30083

An issue was discovered in Mediat 1.4.1. There is a Reflected XSS vulnerability which allows remote attackers to inject arbitrary web script or HTML without authentication via the 'return' parameter in login.php...

CVE-2021-30083: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mediat 1.4.1. There is a Reflected XSS vulnerability which allows remote attackers to inject arbitrary web script or HTML without authentication via the 'return' parameter in login.php...

PT-2021-18598

Name of the Vulnerable Software and Affected Versions Mediat version 1.4.1 Description The issue is related to a Reflected XSS vulnerability, which allows remote attackers to inject arbitrary web script or HTML without authentication. This is achieved via the return parameter in the "login.php"...

PHP Timeclock 1.04 SQL Injection

Exploit Title: PHP Timeclock 1.04 - Time and Boolean Based Blind SQL Injection Date: 03.05.2021 Exploit Author: Tyler Butler Vendor Homepage: http://timeclock.sourceforge.net Software Link: https://sourceforge.net/projects/timeclock/files/PHP%20Timeclock/PHP%20Timeclock%201.04/ Version: 1.04 Test...

CVE-2021-25898

An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Passwords are stored in unencrypted source-code text files. This was noted when accessing the svc-login.php file. The value is used to authenticate a high-privileged user upon authenticating with the server...

CVE-2021-25898

An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Passwords are stored in unencrypted source-code text files. This was noted when accessing the svc-login.php file. The value is used to authenticate a high-privileged user upon authenticating with the server...

CVE-2021-25899

An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. An unauthenticated attacker can send a crafted HTTP request to perform a blind time-based SQL Injection. The vulnerable parameter is param1...

CVE-2021-25899

Void Aural Rec Monitor 9.0.0.1 contains a SQL injection in svc-login.php (param1) exploitable via blind time-based requests. An unauthenticated attacker can trigger the vulnerability to potentially read data, modify data, and perform unauthorized administrative actions. No exploit details are pro...

CVE-2021-25898

The CVE-2021-25898 entry relates to Void Aural Rec Monitor 9.0.0.1, where passwords are stored in unencrypted source-code text files within svc-login.php. This creates an information-disclosure risk because the credential value is used to authenticate a high-privileged user when accessing the ser...

Void Aural Rec Monitor SQL Injection Vulnerability

Void Aural Rec Monitor is an application from the Spanish company Void. Aural Rec Monitor version 9.0.0.1 suffers from a SQL injection vulnerability, which originates in svc-login.php, where an unauthenticated attacker sends a crafted HTTP request to perform a blind time-based SQL injection...

CVE-2021-25899: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. An unauthenticated attacker can send a crafted HTTP request to perform a blind time-based SQL Injection. The vulnerable parameter is param1...