PT-2024-34483 · Unknown · Sourcecodester Simple Inventory System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Inventory System version 1.0 Description: A critical issue has been found in the SourceCodester Simple Inventory System, affecting an unknown functionality of the file login.php. The manipulation of the username argument...

CVE-2024-5093: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in SourceCodester Best House Rental Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The...

Authentication Bypass

friendsofsymfony/user-bundle is vulnerable to Authentication Bypass. The vulnerability is due to an insecure user refresh implementation due to using the primary key instead of the username, which can result in authentication bypass if users are allowed to change usernames...

PT-2024-34369

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Course Registration System version 3.1 Description: A critical issue has been identified, affecting the /admin/index.php file. The manipulation of the username and password arguments leads to SQL injection. This issue can be...

Online Course Registration System 安全漏洞

Online Course Registration System is an online course registration system by the individual developer ANUJ KUMAR. A security vulnerability exists in PHPGurukul Online Course Registration System version 3.1, which originates from the parameters username/password in the file /admin/index.php that c...

CVE-2024-5063: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in PHPGurukul Online Course Registration System 3.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. T...

GitLab 8.0 < 13.11.6 / 13.12 < 13.12.6 / 14.0 < 14.0.2 (CVE-2021-22231)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject access to their profile page via using a specially crafted username. CVE-2021-22231 No...

GitLab < 12.10.13 (CVE-2020-13321)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A vulnerability was discovered in GitLab versions prior to 13.1. Username format restrictions could be bypassed allowing for html tags to be added. CVE-2020-13321 Note that Nessus has not tested for...

Invoke-SessionHunter - Retrieve And Display Information About Active User Sessions On Remote Computers (No Admin Privileges Required)

Retrieve and display information about active user sessions on remote computers. No admin privileges required. The tool leverages the remote registry service to query the HKEYUSERS registry hive on the remote computers. It identifies and extracts Security Identifiers SIDs associated with active...

D-Link DIR-605 Router Information Disclosure Vulnerability

D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page...

FOSUserBundle User Identity Validation Vulnerability

Versions of FOSUserBundle prior to 1.2.1 have been found to be vulnerable to a security issue related to user identity validation. Specifically, user refreshing was performed using the primary key instead of the username, leading to a potential security risk if a user is allowed to change their...

GHSA-8WX3-8M4X-G5H4 FOSUserBundle User Identity Validation Vulnerability

Versions of FOSUserBundle prior to 1.2.1 have been found to be vulnerable to a security issue related to user identity validation. Specifically, user refreshing was performed using the primary key instead of the username, leading to a potential security risk if a user is allowed to change their...

PT-2024-40205

Name of the Vulnerable Software and Affected Versions: FOSUserBundle versions prior to 1.2.1 Description: The issue is related to user identity validation, where user refreshing was performed using the primary key instead of the username. This could lead to a potential security risk if a user is...

Grafana when using email as a username can block other users from signing in

Today we are releasing Grafana 9.2. Alongside with new features and other bug fixes, this release includes a Moderate severity security fix for CVE-2022-39229 We are also releasing security patches for Grafana 9.1.8 and Grafana 8.5.14 to fix these issues. Release 9.2, latest release, also...

Grafana User enumeration via forget password

Today we are releasing Grafana 9.2.4. Alongside other bug fixes, this patch release includes moderate security fixes for CVE-2022-39307. We are also releasing security patches for Grafana 8.5.15 to fix these issues. Release 9.2.4, latest patch, also containing security fix: - Download Grafana 9.2...

Konga is vulnerable to Cross Site Scripting (XSS) attacks

Konga v0.14.9 is vulnerable to Cross Site Scripting XSS via the username parameter...

GHSA-93PF-MRC8-4G3H Konga is vulnerable to Cross Site Scripting (XSS) attacks

Konga v0.14.9 is vulnerable to Cross Site Scripting XSS via the username parameter...

CVE-2024-34243

Konga v0.14.9 is vulnerable to Cross Site Scripting XSS via the username parameter...

CVE-2024-4822

Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the username and password parameters in '/index.php'. This vulnerability allows an attacker to partially take control of the victim's browser session...

CVE-2024-4822

Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the username and password parameters in '/index.php'. This vulnerability allows an attacker to partially take control of the victim's browser session...