Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to disallow users to set their own remote username when shared channels are enabled. This allows a user on a remote to set their remote username prop to an arbitrary...

Kashipara Responsive School Management System 安全漏洞

Kashipara Responsive School Management System is a school management system from Kashipara. A security vulnerability exists in Kashipara Responsive School Management System v1.0, which originates from a vulnerability to SQL injection attack that allows an attacker to execute arbitrary SQL command...

CVE-2024-41238: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in /smsa/studentlogin.php in Kashipara Responsive School Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "username" parameter...

PT-2024-29316 · Unknown · Kashipara Responsive School Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Responsive School Management System version 1.0 Description: A SQL injection issue allows an attacker to execute arbitrary SQL commands via the username parameter in the /smsa/student login.php endpoint. This can lead to data theft...

CVE-2024-41237

A SQL injection vulnerability in /smsa/teacherlogin.php in Kashipara Responsive School Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "username" parameter...

PT-2024-29315

Name of the Vulnerable Software and Affected Versions Kashipara Responsive School Management System version 1.0 Description A SQL injection issue allows an attacker to execute arbitrary SQL commands via the username parameter in the "/smsa/teacher login.php" API endpoint. Recommendations For...

CVE-2024-41237: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in /smsa/teacherlogin.php in Kashipara Responsive School Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "username" parameter...

GO-2024-3024 Mattermost allows a user on a remote to set their remote username prop to an arbitrary string in github.com/mattermost/mattermost-server

Mattermost allows a user on a remote to set their remote username prop to an arbitrary string in github.com/mattermost/mattermost-server...

CVE-2024-33971

SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'username' in '/login.php' parameter...

CVE-2024-33971

CVE-2024-33971 describes an SQL injection vulnerability in the PayPal, Credit Card and Debit Card Payment software (version 1.0, janobe products) where an attacker can exploit the username parameter passed to the /login.php endpoint to retrieve data. Documents consistently tie this to SQL injecti...

CVE-2024-7498

A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been classified as critical. Affected is the function login/login2 of the file /admin/login.php of the component Admin Login Page. The manipulation of the argument username leads to sql injection. It is possible to...

itsourcecode Airline Reservation System SQL注入漏洞

itsourcecode Airline Reservation System is an airline reservation system from itsourcecode, Inc. A SQL injection vulnerability exists in version 1.0 of itsourcecode Airline Reservation System, which stems from an incorrect manipulation of the parameter username that can lead to sql injection...

CVE-2024-33971: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'username' in '/login.php' parameter...

PT-2024-25603 · Payment · Payment

Name of the Vulnerable Software and Affected Versions: Payment software version 1.0 Description: The issue allows an attacker to exploit a SQL injection vulnerability by sending a specially crafted query to the server, potentially retrieving all stored information through the username parameter i...

CVE-2024-7444

A vulnerability classified as critical was found in itsourcecode Ticket Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file login.php of the component Login Page. The manipulation of the argument username leads to sql injection. The attack can be launche...

CVE-2024-6477

The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address...

Ticket Reservation System SQL注入漏洞

Ticket Reservation System is itsourcecode open source ticket reservation system. A SQL injection vulnerability exists in Ticket Reservation System version 1.0, which originates from a SQL injection vulnerability in the username parameter of the Login Page component of the login.php file...

CVE-2024-42348

FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.2 can leak AD username and password when registering a computer. This vulnerability is fixed in 1.5.10.41.3 and 1.6.0-beta.1395...

CVE-2024-42349 FOG has a Log Information Disclosure

FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.4 and earlier can leak authorized and rejected logins via logs stored directly on the root of the web server. FOG Server creates 2 logs on the root of the web server fogloginaccepted.log and fogloginfailed.log...

CVE-2024-42348 FOG leaks sensitive information (AD domain, username and password)

FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.2 can leak AD username and password when registering a computer. This vulnerability is fixed in 1.5.10.41.3 and 1.6.0-beta.1395...