16272 matches found
CVE-2025-7753
🚨 CVE-2025-7753 — SQL Injection PoC Exploit Author: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑7753 Vulnerability: Unauthenticated, time‑based SQL Injection 🔍 Overview A critical SQL Injection vulnerability exists in Online Appointment Booking System 1.0 Code‑Projects in the file...
PT-2026-123366
boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the local network can retrieve system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation. This data aids reconnaissance and...
PT-2026-125109
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver res config ldap may permit LDAP filter injection through a SIP username, allowing an unauthenticat...
Cacti side-channel information leakage vulnerability
Versions of Cacti prior to 1.2.31 contain a side-channel information disclosure vulnerability. This vulnerability arises when a user logs in; the application returns an error message containing only the letter “f” in both uppercase and lowercase, depending on whether the username exists. This may...
ROS-20261023-73-0241
The vulnerability in Tomcat11 relates to bypassing authentication using an alternative username. Exploiting this vulnerability allows a malicious actor to bypass authentication...
ROS-20261023-73-0240
The vulnerability in Tomcat10 relates to bypassing authentication using an alternative username. Exploiting this vulnerability allows a malicious actor to bypass authentication...
Linux Distros Unpatched Vulnerability : CVE-2026-106583
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. CVE-2026-106583 Note that Nessus relies on the...
ROS-20261023-73-0239
The vulnerability in Tomcat relates to bypassing authentication using an alternative username. Exploiting this vulnerability allows a malicious actor to bypass authentication...
CVE-2026-53986
Girafit camera app Android and iOS version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration...
EUVD-2026-107366
Girafit camera app Android and iOS version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration...
CVE-2024-7478
When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabli...
CVE-2024-7478
Multiple WSO2 products are vulnerable to username enumeration when configured to use an external user store . The system fails to sufficiently obscure the existence or validity of usernames during authentication attempts, allowing an attacker to query the mechanism repeatedly to discover valid ac...
EUVD-2024-55813
When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabli...
CVE-2024-7478 Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery
When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabli...
CVE-2026-114401
Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like admin|root or a. and distinguish 'Invalid User' from...
CVE-2026-114401 Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login
Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like admin|root or a. and distinguish 'Invalid User' from...
CVE-2026-114401 Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login
Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like admin|root or a. and distinguish 'Invalid User' from...
CVE-2026-114401
The Trudesk application (versions through 1.2.11 ) is vulnerable to a regular expression injection flaw in the POST /api/v1/login endpoint. This vulnerability allows unauthenticated attackers to perform username enumeration by submitting specific regex patterns, such as (admin|root) or a.*. By an...
CVE-2026-114401 Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login
Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like admin|root or a. and distinguish 'Invalid User' from...
EUVD-2026-107248
Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like admin|root or a. and distinguish 'Invalid User' from...