CVE-2023-7028

CVE-2023-7028 | Account-Take-Over Gitlab Disclamer This code is a proof of concept of the vulnerability, I'm not pushing anyone to use it on gitlab instances they don't own. This tool has been developed for research and educational purposes only and I will not be held responsible for any use you...

CVE-2026-105832

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...

CVE-2026-105832

EspoCRM versions before 10.0.6 are vulnerable to an authentication bypass flaw where the system accepts a login that is stopped at the second factor on routes not requiring authentication. An attacker possessing a 2FA-enabled user's credentials can bypass the second factor to access config parame...

CVE-2026-105832 EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...

EUVD-2026-95019

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...

CVE-2026-105832

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...

CVE-2026-105832 EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...

CVE-2026-62142

Cross-Site Request Forgery CSRF vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0...

CVE-2026-62142

The Melapress WP 2FA plugin (wp-2fa) for WordPress is affected by a Cross-Site Request Forgery (CSRF) vulnerability in versions 4.1.0 and below . This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated user. The documentation does not specify the exact component...

CVE-2026-62142 WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0...

EUVD-2026-94932

Cross-Site Request Forgery CSRF vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0...

WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Filip Kowalski in WordPress Plugin WP 2FA versions = 4.1.0...

Exploit for CVE-2026-107268

CVE-2026-107268: miniOrange 2FA for Drupal returns the site's...

PT-2026-107991

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...

CVE-2026-105832: Improper Authentication

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...

CVE-2026-62142: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0...

PT-2026-107997

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verificatio...

Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197

This module provides TOTP-based two-factor authentication 2FA for Drupal. The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link. This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a...

Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201

This module provides TOTP-based two-factor authentication 2FA for Drupal, with an optional setting to enforce 2FA for all users site-wide. The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on...

WordPress WP Migration Plugin DB & Files – WP Synchro plugin <= 1.16.1 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Migration Plugin DB & Files – WP Synchro versions = 1.16.1...