CVE-2026-71237 Miantang IoT-PHP: Unauthenticated SQL Injection in /userlogin

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $POST'pwd' with no sanitization and concatenates it into a raw SQL string: mysqlquery"select from userlists where username='$username' and password='$password' limit 1". The username value is...

CVE-2026-71237

Miantang IoT-PHP is affected by an unauthenticated SQL injection in the index.php POST /userlogin route. The code reads the password from $_POST['pwd'] and directly concatenates it into a SQL query: select * from userlists where username='$username' and password='$password' limit 1, without prope...

CVE-2025-15094

A weakness has been identified in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The impacted element is the function userLogin of the file src/main/java/com/flycms/web/front/UserController.java of the component User Login. Executing a manipulation of the argument redirectUrl ca...

EUVD-2025-205405

A weakness has been identified in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The impacted element is the function userLogin of the file src/main/java/com/flycms/web/front/UserController.java of the component User Login. Executing manipulation of the argument redirectUrl can...

EUVD-2005-1747

Malware in sbrugna...

EUVD-2020-15901

Malware in sbrugna...

EUVD-2025-22532

Malicious code in bioql PyPI...

CVE-2025-41420

A cross-site scripting xss vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this...

CVE-2025-41420

A cross-site scripting xss vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this...

CVE-2025-41420

CVE-2025-41420 concerns WWBN AVideo 14.4 and the dev master commit 8a8954ff, where the PHP file view/userLogin.php mishandles the cancelUri parameter. This causes a reflected cross-site scripting (XSS) vulnerability: a specially crafted HTTP request can cause arbitrary Javascript execution when a...

CVE-2025-41420

A cross-site scripting xss vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this...

CVE-2025-41420

A cross-site scripting xss vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this...

WWBN AVideo userLogin cancelUri parameter cross-site scripting (XSS) vulnerability

Talos Vulnerability Report TALOS-2025-2209 WWBN AVideo userLogin cancelUri parameter cross-site scripting XSS vulnerability July 24, 2025 CVE Number CVE-2025-41420 SUMMARY A cross-site scripting xss vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and de...

PT-2025-30677 · Wwbn · Avideo

Name of the Vulnerable Software and Affected Versions: WWBN AVideo versions 14.4 and dev master commit 8a8954ff Description: A cross-site scripting xss vulnerability exists due to the improper handling of the cancelUri parameter within the userLogin functionality. A specially crafted HTTP request...

CVE-2020-15612

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxftpmanager.php. When parsing the userLogin parameter, the process...

PT-2022-10327 · Tokheim · Tokheim Profleet Dialog

Name of the Vulnerable Software and Affected Versions: Tokheim Profleet DiaLOG version 11.005.02 Description: The issue is related to SQL Injection. The component affected is the Field UserLogin parameter on the logon page. Recommendations: For Tokheim Profleet DiaLOG version 11.005.02, consider...

The vulnerability of the userLogin parameter in the rConfig configuration management utility allows a hacker to obtain confidential information.

The vulnerability of the userLogin parameter in the rConfig configuration tool exists because special elements are not properly eliminated. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain confidential information through modified POST requests...

CVE-2020-23148

The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request...

CVE-2020-23148

The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request...

rConfig 注入漏洞

rConfig is an open source network configuration management utility. A security vulnerability exists in rConfig that stems from the unfiltered userLogin parameter in ldap/login.php in version 3.9.5 of rConfig. An attacker can use this vulnerability to perform ldap injection and obtain sensitive...