CVE-2014-2947

Bizagi BPM Suite (all versions) contains a reflected XSS in Login.aspx exposed via the txtUsername parameter. CVE-2014-2947 affects Bizagi BPM Suite before 10.3, enabling remote attackers to inject arbitrary JavaScript/HTML in the victim’s browser. CERT/ENISA notes the vulnerability as XSS with a...

CVE-2014-2947: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Login.aspx in Bizagi BPM Suite before 10.3 allows remote attackers to inject arbitrary web script or HTML via the txtUsername parameter...

PT-2014-4975

Name of the Vulnerable Software and Affected Versions Bizagi BPM Suite versions prior to 10.3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the txtUsername parameter in the "Login.aspx" page. Recommendations For versions prior to...

Cross site scripting

Cross-site scripting XSS vulnerability in manager/login.php in CruxSoftware CruxCMS 3.0, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the txtusername parameter...

CVE-2010-2717

Cross-site scripting XSS vulnerability in manager/login.php in CruxSoftware CruxCMS 3.0, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the txtusername parameter...

CVE-2010-2717: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in manager/login.php in CruxSoftware CruxCMS 3.0, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the txtusername parameter...

Sql injection

Multiple SQL injection vulnerabilities in login.asp in NatterChat 1.1 and 1.12 allow remote attackers to execute arbitrary SQL commands via the 1 txtUsername parameter aka Username and 2 txtPassword parameter aka Password in a form generated by home.asp. NOTE: due to lack of details, it is not...

CVE-2008-7049: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in login.asp in NatterChat 1.1 and 1.12 allow remote attackers to execute arbitrary SQL commands via the 1 txtUsername parameter aka Username and 2 txtPassword parameter aka Password in a form generated by home.asp. NOTE: due to lack of details, it is not...

CVE-2008-7048: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in NatterChat 1.12 allow remote attackers to inject arbitrary web script or HTML via the 1 txtUsername parameter to registerDo.asp, as invoked from register.asp, or 2 txtRoomName parameter to roomnew.asp. NOTE: these issues might be resultant from...

CVE-2009-2340: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the txtUserName aka User Name parameter. NOTE: some of these details are obtained from third party information...

Sql injection

SQL injection vulnerability in class.eport.php in Tiny Blogr 1.0.0 rc4, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the txtUsername parameter aka the Username field. NOTE: some of these details are obtained from third party information...

CVE-2009-1453: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in class.eport.php in Tiny Blogr 1.0.0 rc4, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the txtUsername parameter aka the Username field. NOTE: some of these details are obtained from third party information...

Sql injection

SQL injection vulnerability in processlogin.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the 1 txtusername parameter aka username field or the 2 txtpassword parameter aka password field. NOTE: some of these details are obtained from third party...

CVE-2008-5589: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in processlogin.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the 1 txtusername parameter aka username field or the 2 txtpassword parameter aka password field. NOTE: some of these details are obtained from third party...

CVE-2008-0771: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in default.asp in Site2Nite allow remote attackers to execute arbitrary SQL commands via the 1 txtUserName and 2 txtPassword parameters. NOTE: some of these details are obtained from third party information...

CVE-2007-4207: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in adminconsole/index.asp in Gallery In A Box allows remote attackers to execute arbitrary SQL commands via the 1 Username or 2 Password field. NOTE: these fields might be associated with the txtUsername and txtPassword parameters...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in HTTP Commander 6.0, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 LogoffMessage parameter to logofflast.aspx or the 2 txtUsername parameter to Default.aspx. NOTE: The provenance of this informatio...

CVE-2007-0583

CVE-2007-0583 affects HTTP Commander 6.0 (and possibly earlier). It characterses multiple cross-site scripting (XSS) vulnerabilities that could allow remote attackers to inject arbitrary web script or HTML. The exploitation vectors reported are (1) the LogoffMessage parameter to logofflast.aspx a...

CVE-2007-0583: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in HTTP Commander 6.0, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 LogoffMessage parameter to logofflast.aspx or the 2 txtUsername parameter to Default.aspx. NOTE: The provenance of this informatio...

CVE-2007-0196: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admincheckuser.asp in Motionborg Web Real Estate 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the username field txtUserName parameter and possibly other parameters. NOTE: some details were obtained from third party information...