376 matches found
JE CMS 1.0.0 - Authentication Bypass
JE CMS 1.0.0 - Authentication Bypass ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | userLogin; userLogin function is in administrator\library\functions.php. in lines 129-139: if $userName == '' || $password == '' $errorMessage = JEMISMATCHUSERNAMEPASSWORD; else...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in ToutVirtual VirtualIQ Pro 3.2 build 7882 and 3.5 build 8691 allow remote attackers to inject arbitrary web script or HTML via the 1 userId parameter to tvserver/server/user/setPermissions.jsp, 2 deptName parameter to...
CVE-2010-1338
SQL injection vulnerability in tsother.php in the Teamsite Hack plugin 3.0 and earlier for WoltLab Burning Board allows remote attackers to execute arbitrary SQL commands via the userid parameter in a modboard action...
Sql injection
SQL injection vulnerability in the getemployee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter aka userid variable to dispatch.php...
CVE-2009-2734
SQL injection vulnerability in the getemployee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter aka userid variable to dispatch.php...
Sql injection
SQL injection vulnerability in the rGallery plugin 1.2.3 for WoltLab Burning Board WBB3 allows remote attackers to execute arbitrary SQL commands via the userID parameter in the RGalleryUserGallery page to index.php, a different vector than CVE-2008-4627...
CVE-2009-1665
CVE-2009-1665 affects myaccount.php in Easy Scripts Answer and Question Script. The issue allows remote attackers to remove arbitrary user accounts by modifying the userid parameter without supplying additional fields. This indicates an input manipulation vulnerability in the account-management l...
CVE-2009-1665
myaccount.php in Easy Scripts Answer and Question Script allows remote attackers to remove arbitrary user accounts via a modified userid parameter without specifying any additional fields...
CVE-2009-0293
SQL injection vulnerability in profileview.php in Wazzum Dating Software, possibly 2.0, allows remote attackers to execute arbitrary SQL commands via the userid parameter...
Sql injection
SQL injection vulnerability in profileview.php in Wazzum Dating Software, possibly 2.0, allows remote attackers to execute arbitrary SQL commands via the userid parameter...
CVE-2009-0293
SQL injection vulnerability in profileview.php in Wazzum Dating Software, possibly 2.0, allows remote attackers to execute arbitrary SQL commands via the userid parameter...
CVE-2009-0293
CVE-2009-0293: SQL injection vulnerability in profile_view.php of Wazzum Dating Software (possibly v2.0) allows remote attackers to execute arbitrary SQL via the userid parameter. The available documents confirm the vulnerability and affected component but do not provide specifics on affected ver...
CVE-2008-5888
Multiple SQL injection vulnerabilities in Click&Rank allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 hitcounter.asp, 2 userdelete.asp, and 3 userupdate.asp; 4 the userid parameter to adminlogin.asp aka the USERNAME field in admin.asp; and 5 the PassWord paramete...
Sql injection
SQL injection vulnerability in contactauthor.php in Article Publisher Pro 1.5 allows remote attackers to execute arbitrary SQL commands via the userid parameter...
Sql injection
Multiple SQL injection vulnerabilities in ShareCMS 0.1 Beta allow remote attackers to execute arbitrary SQL commands via the 1 eventID parameter to eventinfo.php and the 2 userID parameter to listuser.php...
CVE-2008-2445
Cross-site scripting XSS vulnerability in profile.php in Web Group Communication Center WGCC 1.0.3 PreRelease 1 and earlier allows remote attackers to inject arbitrary web script or HTML via the userid parameter in a show action...
CVE-2008-2347
MyPicGallery 1.0 allows remote attackers to bypass application authentication and gain administrative access by setting the userID parameter to "admin" in a direct request to admin/addUser.php...
CVE-2008-2347
CVE-2008-2347 affects MyPicGallery 1.0. A flaw allows remote attackers to bypass authentication and gain administrative access by setting the userID parameter to "admin" in a direct request to admin/addUser.php, effectively enabling unauthorized admin creation. Root cause: insufficient authorizat...