CVE-2023-26959

Phpgurukul Park Ticketing Management System 1.0 is vulnerable to SQL Injection via the User Name parameter...

PT-2023-20877 · Unknown · Phpgurukul Park Ticketing Management System

Name of the Vulnerable Software and Affected Versions: Phpgurukul Park Ticketing Management System version 1.0 Description: The issue is related to SQL Injection via the User Name parameter. This allows for potential exploitation. No information is provided about the estimated number of potential...

Phpgurukul Park Ticketing Management System SQL注入漏洞

PHPGurukul Park Ticketing Management System is a park ticketing management system from PHPGurukul, Inc. A security vulnerability exists in version 1.0 of the Phpgurukul Park Ticketing Management System, which stems from a discovery containing a SQL injection attack via the User Name parameter...

SourceCodester E-Commerce System 跨站脚本漏洞

Moosikay E-Commerce System is an e-commerce system by the individual developer Arvin Arandilla. A cross-site scripting vulnerability exists in SourceCodester E-Commerce System version 1.0, which stems from a problem with the file admin/user/controller.php?action=edit, where manipulation of the...

PT-2023-17085 · Sourcecodester · Sourcecodester E-Commerce System

Name of the Vulnerable Software and Affected Versions: SourceCodester E-Commerce System version 1.0 Description: A problematic vulnerability was found in the SourceCodester E-Commerce System. The issue affects an unknown functionality of the file admin/user/controller.php?action=edit. The...

Moodle 安全漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle. An attacker exploited the vulnerability to enumerate the names of other users via the...

Internet Bug Bounty: CVE-2023-27533: TELNET option IAC injection

A vulnerability CVE-2023-27533 was found in curl versions 7.7 to 7.88.1 that allowed users to pass on user name and "telnet options" for server negotiation without proper input scrubbing, potentially allowing for the injection of unintended TELNET commands to the telnet connection. The severity o...

CVE-2023-27533

A vulnerability in input validation exists in curl 8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform...

Bitbucket Environment Variable Remote Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Bitbucket Environment Variable RCE', 'Description' = %q For various versions of Bitbucket, there is an authenticated command injection...

UBUNTU-CVE-2021-36402

In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk...

SUSE CVE-2010-3860

IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including 1 user.name, 2 user.home, and 3 java.home system properties, and other sensitive...

SUSE CVE-2013-4996

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 a crafted database name, 2 a crafted user name, 3 a crafted logo URL in the navigation panel, 4 a...

SUSE CVE-2017-7847

Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affects Thunderbird 52.5.2...

SUSE CVE-2017-15671

The glob function in glob.c in the GNU C Library aka glibc or libc6 before 2.27, when invoked with GLOBTILDE, could skip freeing allocated memory when processing the operator with a long user name, potentially leading to a denial of service memory leak...

SUSE CVE-2017-15804

The glob function in glob.c in the GNU C Library aka glibc or libc6 before 2.27 contains a buffer overflow during unescaping of user names with the operator...

SUSE CVE-2018-10995

SchedMD Slurm before 17.02.11 and 17.1x.x before 17.11.7 mishandles user names aka username fields and group ids aka gid fields...

SUSE CVE-2022-24710

Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed i...

GHSA-Q3C8-65Q7-9V78 Cross site scripting in automad/automad

Cross Site Scripting XSS vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user...

CVE-2021-37502

Cross Site Scripting XSS vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user...

CVE-2021-37502

CVE-2021-37502 concerns automad 1.7.5. The vulnerability is a Cross-Site Scripting (XSS) flaw in the user-creation flow, exploitable via the username field when adding a new user. The root cause appears to be insufficient input validation/escaping in accounts.php, allowing injected JavaScript to ...