Code-Projects Intern Membership Management System 注入漏洞

Code-Projects Intern Membership Management System is a Code-Projects open source intern membership management system. Code-Projects Intern Membership Management System version 1.0 suffers from an injection vulnerability, which originates from a SQL injection due to incorrect operation of the...

CVE-2025-54834

OPEXUS FOIAXpress Public Access Link PAL version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check for the existence of valid usernames. There are no rate-limiting mechanisms in place...

CVE-2013-10036

A stack-based buffer overflow vulnerability exists in Beetel Connection Manager version PCWBTLINDV1.0.0B04 when parsing the UserName parameter in the NetConfig.ini configuration file. A crafted .ini file containing an overly long UserName value can overwrite the Structured Exception Handler SEH,...

CVE-2025-8467

A vulnerability was found in code-projects Wazifa System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /controllers/regcontrol.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely...

CVE-2025-6077

Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions...

CVE-2025-6077

The Partner Software Product and the corresponding Partner Web application (a geographic information system and its back-end review system) utilize the same default username and password for the administrator account across all versions. This security flaw allows for unauthorized access and poten...

CVE-2025-6077 CVE-2025-6077

Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions...

CVE-2025-8467: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in code-projects Wazifa System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /controllers/regcontrol.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely...

PT-2025-31719

Name of the Vulnerable Software and Affected Versions Partner Software Product affected versions not specified Partner Web application affected versions not specified Description Partner Software’s Partner Software Product and corresponding Partner Web application utilize the same default usernam...

Code-Projects Wazifa System 注入漏洞

Code-Projects Wazifa System is a Code-Projects open source content management system. An injection vulnerability exists in Code-Projects Wazifa System version 1.0, which originates from a SQL injection due to incorrect manipulation of the parameter Username in the file /controllers/regcontrol.php...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via pathLogin. An attacker can determine whether a username exists by measuring response times. Remediation Upgrade github.com/hashicorp/vault/builtin/credential/userpass to version 1.20.1 or higher. References - GitHub...

CVE-2025-6011 Timing Side-Channel in Vault’s Userpass Auth Method

A timing side channel in Vault and Vault Enterprise’s “Vault” userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise...

CVE-2025-6011 Timing Side-Channel in Vault’s Userpass Auth Method

A timing side channel in Vault and Vault Enterprise’s “Vault” userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise...

CVE-2025-6011

CVE-2025-6011 describes a timing side-channel in Vault and Vault Enterprise's userpass authentication that could let an attacker distinguish existing vs non-existing usernames, enabling possible username enumeration. Root cause: timing differences during user existence checks in the Userpass meth...

Timing Side-Channel in Vault’s Userpass Auth Method

Summary A timing side channel in Vault and Vault Enterprise’s “Vault” userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s userpass auth method. This vulnerability, identified as CVE-2025-6011, is...

HashiCorp Vault Community Edition和HashiCorp Vault Enterprise 安全漏洞

HashiCorp Vault Enterprise and HashiCorp Vault Community Edition are both products of HashiCorp, Inc. of the U.S. HashiCorp Vault Enterprise is an enterprise information archiving platform.HashiCorp Vault HashiCorp Vault Enterprise is an enterprise information archiving platform, and HashiCorp...

CVE-2025-6011: Observable Discrepancy

A timing side channel in Vault and Vault Enterprise’s “Vault” userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise...

Online Farm System register.php File SQL Injection Vulnerability

Online Farm System is an online farm system. Online Farm System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter Username in the file /register.php. An attacker can exploit this vulnerability to execute...

Code-Projects Online Medicine Guide 注入漏洞

Online Medicine Guide is an online medical guide. Online Medicine Guide suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the parameter uname in the file /login.php. The vulnerability can be exploited by an attacker to execute...

CVE-2025-54834

OPEXUS FOIAXpress Public Access Link PAL version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check for the existence of valid usernames. There are no rate-limiting mechanisms in place...