CVE-2011-2153

Login.aspx in the SmarterTools SmarterStats 6.0 web server supports URLs containing txtUser and txtPass parameters in the query string, which makes it easier for context-dependent attackers to discover credentials by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history, related to a "cross-domain Referer leakage" issue.

• CWE-200

• http://www.kb.cert.org/vuls/id/240150US Government Resource
• http://www.kb.cert.org/vuls/id/MORO-8GYQR4US Government Resource
• http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67829
• http://www.kb.cert.org/vuls/id/240150US Government Resource
• http://www.kb.cert.org/vuls/id/MORO-8GYQR4US Government Resource
• http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67829

Published

May 20, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-2147Openswan 2.2.x does not properly restrict permissions for (1…
• CVE-2011-2148Admin/frmSite.aspx in the SmarterTools SmarterStats 6.0 web …
• CVE-2011-2149Multiple SQL injection vulnerabilities in the SmarterTools S…
• CVE-2011-2150The SmarterTools SmarterStats 6.0 web server does not proper…
• CVE-2011-2151The (1) Admin/frmEmailReportSettings.aspx, (2) Admin/frmGene…
• CVE-2011-2152The SmarterTools SmarterStats 6.0 web server generates web p…
• CVE-2011-2154login.aspx in the SmarterTools SmarterStats 6.0 web server d…
• CVE-2011-2155Login.aspx in the SmarterTools SmarterStats 6.0 web server g…
• CVE-2011-2156The SmarterTools SmarterStats 6.0 web server allows remote a…
• CVE-2011-2157The (1) Admin/frmEmailReportSettings.aspx and (2) Admin/frmG…
• CVE-2011-2158The SmarterTools SmarterStats 6.0 web server sends incorrect…
• CVE-2011-2159The SmarterTools SmarterStats 6.0 web server omits the Conte…