CVE-2009-4347: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in daloradius-users/login.php in daloRADIUS 0.9-8 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter...

CVE-2009-4237: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.8.5 allow remote attackers to inject arbitrary web script or HTML via 1 the req parameter to login.php, and allow remote authenticated users to inject arbitrary web script or HTML via 2 the key parameter to...

Pligg login.php return Parameter Arbitrary Site Redirect

The remote host is running Pligg, an open source content management system. The installed version of Pligg contains an open redirect, in the 'return' parameter of its 'login.php' script. This could be abused to launch a phishing attack to trick users into visiting malicious sites. Note that this...

Sql injection

SQL injection vulnerability in login.php in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-3758

CVE-2009-3758 is a SQL injection in login.php of the XenServer Resource Kit / XenCenterWeb. The vulnerability allows remote attackers to execute arbitrary SQL commands via the username parameter, as described in NVD/NIST and mirrored in multiple sources. Public exploit coverage is indicated by a ...

CVE-2009-3758: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-3543: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in phenotype/admin/login.php in Phenotype CMS before 2.9 allows remote attackers to execute arbitrary SQL commands via the user parameter aka the login name...

CVE-2009-3422

login.php in Zenas PaoLiber 1.1, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

Authentication flaw

login.php in Zenas PaoLink 1.0, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

CVE-2009-3423

CVE-2009-3423 affects Zenas PaoLink 1.0. When login_globals is enabled, an attacker can bypass authentication by setting the login_ok parameter to 1 in login.php, gaining administrative access. The NVD entry records a CVSSv2 base score of 6.8 (MEDIUM) with network attack vector and no authenticat...

CVE-2009-3423

login.php in Zenas PaoLink 1.0, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

CVE-2009-3430

The CVE-2009-3430 entry concerns Allomani Mobile 2.5, where a SQL injection flaw in login.php allows remote attackers to manipulate the database by supplying crafted input in the username field during login. The vulnerability is caused by unsafely handling user input in the login action, enabling...

CVE-2009-3422

login.php in Zenas PaoLiber 1.1, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

CVE-2009-3421

CVE-2009-3421 affects Zenas PaoBacheca Guestbook 2.1. The vulnerability is in login.php and arises when PHP register_globals is enabled. An attacker can bypass authentication and gain administrative access by setting the login_ok parameter to 1. The NVD notes a high-severity impact (confidentiali...

CVE-2009-3430: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in Allomani Mobile 2.5 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action...

CVE-2009-3423: Improper Authentication

login.php in Zenas PaoLink 1.0, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

CVE-2009-3421: Improper Authentication

login.php in Zenas PaoBacheca Guestbook 2.1, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

CVE-2009-3422: Improper Authentication

login.php in Zenas PaoLiber 1.1, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

CVE-2009-3327

Multiple SQL injection vulnerabilities in WX-Guestbook 1.1.208 allow remote attackers to execute arbitrary SQL commands via the 1 QUERY parameter to search.php and 2 USERNAME parameter to login.php. NOTE: some of these details are obtained from third party information...

CVE-2009-3327: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in WX-Guestbook 1.1.208 allow remote attackers to execute arbitrary SQL commands via the 1 QUERY parameter to search.php and 2 USERNAME parameter to login.php. NOTE: some of these details are obtained from third party information...