I'll wear out the little nubs on the home 'f' and 'k' keys. Without those, I'm typing blind.

My thoughts exactly and thanks for the confirmation. Sometime we have more to fear than fear itself.

I have no beef with the vendor either way. We have no desire to use what was demonstrated due to cost, even moreso after witnessing the 'holes' online. My thought is two-fold. Mention my discovery but perhaps only the SQL Error lest they believe we're doing something malicious by using an unauthorized login. Or, to keep quiet knowing my little discovery is proof enough not to use their services. Or would it a stretch of imagination that perhaps they'll discover this faux pas or our inadvertent login.

During a Webinar with one of our vendors, I wanted to see for myself the site(s) the moderator was demonstrating online. So I typed in the site URL verbatim and suddently a SQL Server Error appeared which was quite explicit in it's explanation. Naturally this was due to my not properly logging into the site. I located the login page. On a lark, I typed the moderator's Username AND the same as password. I was in! This wasn't a demo site AND was secure 'https://' as well. Should I keep my mouth shut or tell said vendor about the SQL Error and how easy his password was to break?