2612 matches found
CVE-2021-25898: Cleartext Storage of Sensitive Information
An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Passwords are stored in unencrypted source-code text files. This was noted when accessing the svc-login.php file. The value is used to authenticate a high-privileged user upon authenticating with the server...
PT-2021-16830
Name of the Vulnerable Software and Affected Versions Void Aural Rec Monitor version 9.0.0.1 Description An issue was discovered in svc-login.php, allowing an unauthenticated attacker to send a crafted HTTP request and perform a blind time-based SQL Injection. The vulnerable parameter is param1...
PT-2021-16829
Name of the Vulnerable Software and Affected Versions Void Aural Rec Monitor version 9.0.0.1 Description An issue was discovered in the svc-login.php file. Passwords are stored in unencrypted source-code text files, which is noted when accessing the svc-login.php file. The value is used to...
CVE-2021-24228
The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form wp-login.php is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of...
CVE-2021-24228: Improper Neutralization of Input During Web Page Generation
The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form wp-login.php is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of...
Stop Spammers < 2021.9 - Reflected Cross-Site Scripting (XSS)
The plugin did not escape user input when blocking requests such as matching a spam word, outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue. From an IP not in the Allow List...
eChat 1.0 SQL Injection Vulnerability
Exploit Title: eChat | Time-Based Blind SQL Injection Exploit Author: email protected Vendor Homepage: https://www.sourcecodester.com/php/10498/echat-simple-chat-system-app-using-phpmysql.html Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/echat.zip Version:...
eChat 1.0 SQL Injection
Exploit Title: eChat | Time-Based Blind SQL Injection Exploit Author: [email protected] Date: 2021-02-21 Vendor Homepage: https://www.sourcecodester.com/php/10498/echat-simple-chat-system-app-using-phpmysql.html Software Link:...
CVE-2020-35952
login.php in PHPFusion aka PHP-Fusion Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password i.e., not a single "Incorrect username or password" message in both cases, which might allow enumeration...
CVE-2020-35952
CVE-2020-35952 affects PHPFusion (PHP-Fusion) Andromeda 9.x before 2020-12-30. The issue is that login.php generates error messages that differentiate between an incorrect username and an incorrect password, rather than a single generic message, which could enable user enumeration. The connected ...
CVE-2020-35952
login.php in PHPFusion aka PHP-Fusion Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password i.e., not a single "Incorrect username or password" message in both cases, which might allow enumeration...
CVE-2020-35952: Undefined Security Weakness
login.php in PHPFusion aka PHP-Fusion Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password i.e., not a single "Incorrect username or password" message in both cases, which might allow enumeration...
PT-2021-11884
Name of the Vulnerable Software and Affected Versions: PHPFusion aka PHP-Fusion Andromeda versions 9.x before 2020-12-30 Description: The issue arises from the login.php file generating distinct error messages for incorrect usernames and passwords, rather than a unified message. This distinction...
CVE-2021-3002
Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter...
CVE-2021-3002
Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter...
CVE-2021-3002
Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter...
CVE-2021-3002: Improper Neutralization of Input During Web Page Generation
Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter...
CVE-2020-20285: Improper Neutralization of Input During Web Page Generation
There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php...
PT-2020-15253
Name of the Vulnerable Software and Affected Versions zzcms version 2019 Description The issue is related to a Cross-Site Scripting XSS vulnerability in the user login page. Users can inject JavaScript code through the referer header via the "user/login.php" endpoint. This allows attackers to...