822 matches found
CVE-2021-37502
Cross Site Scripting XSS vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user...
CVE-2021-36402
In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk...
CVE-2021-34220
Cross-site scripting in tr069config.htm in TOTOLINK A3002R version V1.1.1-B20200824 Important Update, new UI allows attackers to execute arbitrary JavaScript by modifying the "User Name" field or "Password" field...
CVE-2021-42326
Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter...
CVE-2020-28954
web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting control characters in a user name...
CVE-2020-5305
Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen...
CVE-2020-17476
Mibew Messenger before 3.2.7 allows XSS via a crafted user name...
CVE-2015-6969
Cross-site scripting XSS vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link...
CVE-2019-16148
Sakai through 12.6 allows XSS via a chat user name...
CVE-2013-3959
The Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, exhibits different behavior for NetBIOS user names depending on whether the user account exists, which allows remote authenticated users to enumerate account names via crafted U...
CVE-2005-3031
Buffer overflow in vxFtpSrv 0.9.7 allows remote attackers to execute arbitrary code via a long USER name...
SourceCodester Best Employee Management System 跨站脚本漏洞
SourceCodester Best Employee Management System is a SourceCodester open source employee management system. A security vulnerability exists in version 1.0 of the SourceCodester Best Employee Management System due to an improper cleanup of the input of the parameters websiteimage, fname, lname,...
Ensure That Passwords Do Not Contain User Names
To ensure user security, you must configure passwords that do not contain user names. If a password is the same as the user name or the user name in reverse order, or contains the user name, attackers can guess the password easily. This requirement is not exerted on passwords of users whose names...
SUSE CVE-2017-12844
Cross-site scripting XSS vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary web script or HTML via a crafted user name...
SAP KMC WPC 安全漏洞
SAP KMC WPC is a combination of enterprise content management and web publishing components from SAP. An information disclosure vulnerability exists in SAP KMC WPC, which can be exploited by an attacker to retrieve a user name via a simple parameter query, resulting in the disclosure of sensitive...
Gym Management System 注入漏洞
Gym Management System is a gym management system from SourceCodester. An injection vulnerability exists in Gym Management System version 1.0, which stems from an incorrect manipulation of the parameter username that can lead to SQL injection...
CVE-2025-2202
CVE-2025-2202 is a broken access control vulnerability in the Innovación y Cualificación local administration plugin’s ajax.php. Affected component: local administration plugin (ajax.php). Root cause: improper access control that permits an attacker to obtain sensitive user data (id, name, login,...
U.S. Dept Of Defense: Information Disclosure in API Endpoint /users
An endpoint /users was exposing sensitive user information, including id, first name, last name, email, role, and authdata, to unauthenticated users. This allowed anyone to retrieve private user details without authentication...
