165 matches found
CVE-2020-22166
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\forgot-password.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...
CVE-2020-22166: Improper Neutralization of Special Elements used in an SQL Command
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\forgot-password.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...
CVE-2020-28874: Improper Authentication
reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered an invalid token parameter...
CVE-2020-28874
The CVE-2020-28874 issue affects ProjectSend’s reset-password.php before r1295, where incorrect business logic allows password reset without a valid token. Root cause: user_data is derived from an uncleaned username (GET parameter) and then reused in POST flow, enabling an attacker to trick the s...
CVE-2020-12429: Improper Neutralization of Special Elements used in an SQL Command
Online Course Registration 2.0 has multiple SQL injections that would can lead to a complete database compromise and authentication bypass in the login pages: admin/change-password.php, admin/checkavailability.php, admin/index.php, change-password.php, checkavailability.php, includes/header.php,...
CVE-2012-4526
piwigo has XSS in password.php incomplete fix for CVE-2012-4525...
CVE-2012-4525
piwigo has XSS in password.php...
Default credentials
piwigo has XSS in password.php...
CVE-2012-4526
piwigo has XSS in password.php incomplete fix for CVE-2012-4525...
Design/Logic Flaw
piwigo has XSS in password.php incomplete fix for CVE-2012-4525...
CVE-2012-4526
piwigo has XSS in password.php incomplete fix for CVE-2012-4525...
CVE-2012-4526
Piwigo is affected by a cross-site scripting (XSS) vulnerability in password.php. This entry (CVE-2012-4526) indicates an incomplete fix for CVE-2012-4525, with XSS described in the same file and linked citations. The provided documents do not specify affected versions, exploit status, in-the-wil...
CVE-2012-4525
piwigo has XSS in password.php...
CVE-2012-4525
Piwigo has a Cross-Site Scripting (XSS) vulnerability in password.php (CVE-2012-4525). Multiple sources confirm the issue exists in Piwigo and some Red Hat/Ubuntu entries describe an incomplete fix for CVE-2012-4525, indicating remediation is not fully clear from the provided documents. The affec...
CVE-2012-4526: Improper Neutralization of Input During Web Page Generation
piwigo has XSS in password.php incomplete fix for CVE-2012-4525...
CVE-2019-12742: Authorization Bypass Through User-Controlled Key
Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference a modified username POST parameter...
Teameyo Project Management System 1.0 - SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Teameyo - Project Management System 1.0 - SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://www.teameyo.com/ Software Link: https://codecanyon.net/item/teameyo-project-management-system/23142804 Version: 1.0...
rz.uni-augsburg.de XSS vulnerability
Open Bug Bounty ID: OBB-670714 Description| Value ---|--- Affected Website:| rz.uni-augsburg.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
microkeeper.com.au XSS vulnerability
Open Bug Bounty ID: OBB-664759 Description| Value ---|--- Affected Website:| microkeeper.com.au Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...