91 matches found
CVE-2025-71383
Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request from the local Wi-Fi network that lacks a /api/login username or password field. This occurs because of an error in a JSON parser...
WPForce
WPForce - Suite de Ataque a WordPress ACERCA DE: WPForce es un conjunto de herramientas de ataque a WordPress. Actualmente contiene 2 scripts: WPForce, que fuerza bruta inicios de sesión a través de la API, y Yertle, que sube shells una vez que se han encontrado credenciales de administrador...
CVE-2023-27742
CVE-2023-27742 IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login. Description IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login. Vulnerability Type SQL Injection Vendor of Product IDURAR...
CVE-2025-55462
CVE-2025-55462 Vulnerability Summary A Cross-Origin Resource Sharing CORS misconfiguration was identified in Eramba Community and Enterprise Editions v3.26.0. The application reflects attacker-controlled Origin headers in the Access-Control-Allow-Origin response header on the /system-api/login...
CVE-2025-65427
CVE-2025-65427: Authentication Rate Limiting Issue in Dbit N300 T1 Pro CVE ID: CVE-2025-65427 Date: 2025-12-16 Discoverer: Kirubel Product: Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router Firmware Version: V1.0.0 Description An issue was discovered in the Dbit N300 T1 Pro Easy Setup Wireless...
CVE-2023-54391
Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...
CVE-2023-54391: Missing Critical Step in Authentication
Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...
PT-2026-84529
Name of the Vulnerable Software and Affected Versions Proxmox Virtual Environment VE versions 7.0 through 8.0 Description An authentication bypass exists in libpve-access-control that allows unauthenticated attackers to authenticate as any enabled user who does not have a second factor configured...
VulnCheck KEV: CVE-2023-54391
Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...
CVE-2026-18721
A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has be...
EUVD-2026-52570
A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has be...
CVE-2026-18721: URL Redirection to Untrusted Site
A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has be...
PT-2026-67636
A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has be...
MAL-2026-11005 Malicious code in n8n-nodes-quick-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a3ad37cc152517b09b8ee72a009a179399ddf802e7f22c126c9d104b4252d5a On require/import, index.js spawns /bin/bash wired to a TCP socket at hardcoded IP 103.27.109.184:8895, giving the remote operator an interactive she...
CVE-2026-32825
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the...
CVE-2026-32825 dataCycle No Brute-Force Protection On Web And API Login Endpoints
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the...
CVE-2026-32825 dataCycle No Brute-Force Protection On Web And API Login Endpoints
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the...
PT-2026-61631
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the...
CVE-2026-55207: Weak Password Recovery Mechanism for Forgotten Password
Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server...
Improper Validation of Specified Quantity in Input
Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the api/login process. An attacker can exhaust system resources and cause service disruption by submitting extremely large password values during authentication requests. Remediatio...