43167 matches found
Apache Axis2 Default Login
Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service. id: CVE-2010-02...
CVE-2026-13413: Improper Access Control
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise hidden site, including hidden published pages, ...
CVE-2026-15897: Improper Privilege Management
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function, in its registerloginaction='update' flow, trusting an attacker-supplied...
The vulnerability of the final point /login/oauth/userinfo of the Git repository management system Gitea, which allows a hacker to compromise the confidentiality and integrity of the protected information
The vulnerability of the final point /login/oauth/userinfo of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information...
PT-2026-104078
Name of the Vulnerable Software and Affected Versions Super Forms – Drag & Drop Form Builder versions prior to 6.3.317 Description An issue exists in the Register & Login add-on where the before email success msg function, during the register login action='update' flow, trusts a user-supplied use...
GO-2026-6564 Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauth
Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauth...
GO-2026-6589 ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel
ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel...
CVE-2026-102369
Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service th...
EUVD-2026-90983
Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service th...
PYSEC-2026-4169 social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend
Impact The LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victi...
PYSEC-2026-4062 lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
Summary The POST /login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can submit unlimited password guesses at full network speed. Details python lightrag/api/lightragserver.py:2161 @app.post"/login" async def loginformdata: OAuth2PasswordRequestForm =...
lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
SummaryThe POST /login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can submit unlimited password guesses at full network speed. Detailspython lightrag/api/lightragserver.py:[email protected]"/login"async def loginformdata: OAuth2PasswordRequestForm =...
CVE-2026-83589
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter rd during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an...
BIT-RABBITMQ-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...
CVE-2026-83589 Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter rd during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an...
CVE-2026-83589
A flaw in oauth-proxy allows for an open redirect due to insufficient validation of the destination redirect parameter (rd) during post-login redirection. Specifically, the application may be susceptible to bypasses using // and / sequences. A remote attacker can exploit this by tricking a user i...
CVE-2026-83589 Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter rd during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an...
CVE-2026-15989 Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function whitelisting the client-submitted 'role' key and copying it into the...
CVE-2026-15989
The Super Forms – Drag & Drop Form Builder plugin for WordPress (versions up to and including 6.3.316 ) is vulnerable to unauthenticated privilege escalation . The root cause lies in the Register & Login add-on's before_email_success_msg() function, which whitelists the client-submitted role key ...
CVE-2026-15989 Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function whitelisting the client-submitted 'role' key and copying it into the...