982 matches found
CVE-2012-0262
op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the password parameter...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in admin/login in X3 CMS 0.4.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, 2 username, or 3 password parameter...
Session expiry pages may echo password in clear text
The "session expiry" and "XSRF token missing" pages will echo any submitted values. This may result in echoing the submitted password to the page in plain text if triggered on the WebSudo authentication page. Modify the error pages sessionexpired.jsp and xsrfmissing.jsp so they don't echo...
PT-2012-5160 · Pbboard · Pbboard
Name of the Vulnerable Software and Affected Versions: PBBoard version 2.1.4 Description: The issue allows remote attackers to change the password of arbitrary user accounts. This is achieved by exploiting the new password page, specifically through the member id and new password parameters to th...
CVE-2010-4959
SQL injection vulnerability in the login feature in Pre Projects Pre Podcast Portal allows remote attackers to execute arbitrary SQL commands via the password parameter...
CVE-2010-3608
Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the 1 id and 2 password pw parameters to a admin.php or b user.php...
CVE-2010-2509
The CVE-2010-2509 entries describe cross-site scripting vulnerabilities in 2daybiz Web Template Software. The affected components are the category.php file (parameter: keyword) and memberlogin.php (parameter: password). The underlying issue is improper handling of user-supplied input leading to s...
Sql injection
Multiple SQL injection vulnerabilities in redir.asp in VU Web Visitor Analyst allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameter. NOTE: some of these details are obtained from third party information...
Sql injection
Multiple SQL injection vulnerabilities in login.php in Project Man 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameter...
Sql injection
Multiple SQL injection vulnerabilities in login.php in PHPCityPortal allow remote attackers to execute arbitrary SQL commands via the 1 requsername aka Username and 2 reqpassword aka Password parameters. NOTE: some of these details are obtained from third party information...
CVE-2009-4721
CVE-2009-4721 affects Andrews-Web (A-W) BannerAd 1.0, with multiple SQL injection vulnerabilities in Admin/index.asp that allow remote attackers to execute arbitrary SQL commands via the (1) User and (2) Password parameters. The root cause is unsafely constructed SQL queries in that page, enablin...
CVE-2010-0698
SQL injection vulnerability in backoffice/login.asp in Dynamicsoft WSC CMS 2.2 allows remote attackers to execute arbitrary SQL commands via the Password parameter. NOTE: some of these details are obtained from third party information...
Sql injection
SQL injection vulnerability in index.php in OpenDocMan 1.2.5 allows remote attackers to execute arbitrary SQL commands via the frmpass aka Password parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2008-6990
SQL injection vulnerability in gallery.php in Easy Photo Gallery aka Ezphotogallery 2.1 allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
tomcat6 Information disclosure in authentication classes
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /jsecuritycheck with malformed URL encoding of passwords, related to improper error checking in the 1...
Sql injection
SQL injection vulnerability in index.php in phpBugTracker 1.0.3 allows remote attackers to execute arbitrary SQL commands via the password parameter...
CVE-2009-1850
SQL injection vulnerability in index.php in phpBugTracker 1.0.3 allows remote attackers to execute arbitrary SQL commands via the password parameter...
CVE-2008-6525
SQL injection vulnerability in the Admin Panel in Nice PHP FAQ Script Knowledge base Script allows remote attackers to execute arbitrary SQL commands via the Password parameter aka the pass field...
Sql injection
SQL injection vulnerability in the Admin Panel in Nice PHP FAQ Script Knowledge base Script allows remote attackers to execute arbitrary SQL commands via the Password parameter aka the pass field...