CVE-2023-40946

Schoolmate 1.3 is vulnerable to SQL Injection in the variable $username from SESSION in ValidateLogin.php...

EUVD-2023-60228

SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows through maliciously crafted environment variables. Attackers can manipulate the username environment variable with format string payloads to potentially execute...

CVE-2023-53966 SOUND4 LinkAndShare Transmitter 1.1.2 Format String Stack Buffer Overflow

SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows through maliciously crafted environment variables. Attackers can manipulate the username environment variable with format string payloads to potentially execute...

PT-2025-52703

Name of the Vulnerable Software and Affected Versions SOUND4 LinkAndShare Transmitter version 1.1.2 Description SOUND4 LinkAndShare Transmitter version 1.1.2 contains a format string vulnerability. This allows attackers to trigger memory stack overflows through maliciously crafted environment...

EUVD-2018-11931

Malware in sbrugna...

EUVD-2025-31576

Malicious code in bioql PyPI...

PT-2025-7163

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier Description: A missing authorization issue in the maxprofile/users/routes.lua file, specifically in the "users endpoint", allows an authenticated attacker with low privileges to enumerate users by...

CVE-2024-52010

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. A command injection vulnerability in the Web SSH feature allows an authenticated attacker to execute arbitrary commands as root on the host. Zoraxy has a Web SSH terminal feature that allows authenticated users to connect to SSH...

CVE-2024-52010 Zoraxy has an authenticated command injection in the Web SSH feature

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. A command injection vulnerability in the Web SSH feature allows an authenticated attacker to execute arbitrary commands as root on the host. Zoraxy has a Web SSH terminal feature that allows authenticated users to connect to SSH...

CVE-2023-52723

The KDE libksieve email filtering library (versions before 23.03.80 ) contains a vulnerability in kmanagesieve/session.cpp where a username variable is accidentally assigned a password value. This flaw causes the application to write user passwords in cleartext into server logs. Impacted systems ...

PT-2023-24354 · Unknown · Remote Clinic

Name of the Vulnerable Software and Affected Versions: RemoteClinic version 2.0 Description: The issue is a SQL injection vulnerability located in the /staff/edit.php file. This vulnerability can be exploited through the username and password variables. Recommendations: For RemoteClinic version...

CVE-2023-25104

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

PT-2022-27113 · Boa · Boa

Name of the Vulnerable Software and Affected Versions: Boa version 0.94.14rc21 Description: The issue concerns SQL Injection via the username variable. However, it is noted that this vulnerability is disputed by multiple third parties because Boa does not ship with any support for SQL...

Cross-site Scripting (XSS)

Apache JSPWiki is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization on the user preference page via the UserName variable...

CVE-2021-40408

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13620121102. At 1 or 2, based on DDNS type, the ddns-username variable, that has the value of the userName parameter provided through the SetDdns API, is not validated properly. Th...

PT-2019-14857

Name of the Vulnerable Software and Affected Versions Infosysta In-App & Desktop Notifications app version 1.6.13 J8 for Jira Description An issue in the Infosysta In-App & Desktop Notifications app allows unauthorized access to a different user's notifications. This can be achieved by modifying...

CVE-2018-1352: Use of Externally-Controlled Format String

A format string vulnerability in Fortinet FortiOS 5.6.0 allows attacker to execute unauthorized code or commands via the SSH username variable...

AneCMS SQL Injection

Exploit Title: anecms SQli Date: 23/08/2010 Author: Sweet Contact : [email protected] Software Link: anecms.com Download: anecms.com/anecms.zip Version: All Tested on: WinXp sp3 Description : anecms is an open source blog manager Sqli: The POST variable username has been set to sweet'" on...

AneCMS - '/registre/next' SQL Injection

Exploit Title: anecms SQli Date: 23/08/2010 Author: Sweet Contact : [email protected] Software Link: anecms.com Download: anecms.com/anecms.zip Version: All Tested on: WinXp sp3 Description : anecms is an open source blog manager...

Oracle Secure Backup Administration Server Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Oracle Secure Backup. User interaction is not required to exploit this vulnerability. The specific flaw exists in the logic used to authenticate a user to the administration server running on port...