685 matches found
EUVD-2026-125188
Vvveb before 1.0.9.0 contains an authentication bypass vulnerability in generateCookie in system/user/user.php that uses loose comparison to validate MD5 cookie hashes. Unauthenticated attackers can brute-force cookie values until the server's MD5 computation yields a 0e magic hash, then forge...
Simplog-Exploit
Simplog-Exploit This repository contains the setup, exploit and patch for CVE-2009-4092 Simplog CSRF Vulnerability. The vulnerabily exists in the user.php file of Simplog 0.9.3.2, a web application used for providing people with an easy way to create and maintain a blog on their personal websites...
CVE-2026-126544
WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrar...
CVE-2026-126544 WWBN AVideo 6.5 through 29.7.1 Email Verification Bypass via User::verifyCode()
WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrar...
CVE-2026-126544
WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrar...
CVE-2026-126544 WWBN AVideo 6.5 through 29.7.1 Email Verification Bypass via User::verifyCode()
WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrar...
CVE-2026-126544
WWBN AVideo versions 6.5 through 29.7.1 are vulnerable to an email verification bypass within the User::verifyCode() function in objects/user.php. The root cause is a PHP loose comparison of the recoverPass token. This allows registered users to reuse an installation-wide salt from their own veri...
EUVD-2026-123069
WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrar...
CVE-2026-126544: WWBN AVideo: WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in…
WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrar...
PT-2026-144923
WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrar...
PT-2026-140977
A security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this issue is the function store temporary password of the file public/local/iomad/classes/company user.php of the component Password Field Handler. Such manipulation leads to information disclosure...
EUVD-2026-117195
A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1. This affects an unknown function of the file /dipam/check-user.php. Such manipulation of the argument abbr leads to sql injection. It is possible to launch the attack remotely. The...
CVE-2026-122048
A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1. This affects an unknown function of the file /dipam/check-user.php. Such manipulation of the argument abbr leads to sql injection. It is possible to launch the attack remotely. The...
CVE-2026-122048 Campcodes Division Regional Athletic Meet Game Result Matrix System check-user.php sql injection
A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1. This affects an unknown function of the file /dipam/check-user.php. Such manipulation of the argument abbr leads to sql injection. It is possible to launch the attack remotely. The...
CVE-2026-122048
A vulnerability exists in the Campcodes Division Regional Athletic Meet Game Result Matrix System (up to version 2.1 ). The flaw is located in an unknown function within the /dipam/check-user.php file. Attackers can perform a remote SQL injection by manipulating the abbr argument. An exploit is p...
PT-2026-137237
A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1. This affects an unknown function of the file /dipam/check-user.php. Such manipulation of the argument abbr leads to sql injection. It is possible to launch the attack remotely. The...
PT-2026-110502
A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMS User.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly...
PT-2026-104675
A weakness has been identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/add user.php of the component Password Handler. Executing a manipulation of the argument Password can lead to missing encryption of sensitive data. It is possible to...