1536 matches found
evilginx
Evilginx v.1.1.0 QUESTA VERSIONE È OBSOLETA. USA L'ULTIMA VERSIONE! EVILGINX 2:https://github.com/kgretzky/evilginx2 Evilginx è un framework per attacchi man-in-the-middle utilizzato per il phishing di credenziali e cookie di sessione di qualsiasi servizio web. Il suo core gira sul server HTTP...
EUVD-2026-96039
The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability exists because handleloginaction performs no server-side check — via transient, session marker, or equivalent — that a requester completed step-1...
CVE-2026-104732: Improper Authentication
The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability exists because handleloginaction performs no server-side check — via transient, session marker, or equivalent — that a requester completed step-1...
GHSA-45GV-9WJV-XH7P Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
Summary nginx-ui supports two second-factor methods — TOTP OTP and WebAuthn passkeys — and reports an account as 2FA-enabled when either is configured. However, the password login endpoint POST /api/login only enforces a second factor when a TOTP secret is present. An account that has registered ...
CVE-2026-107808 Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password...
BIT-GHOST-2026-103283 Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling
Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to...
CVE-2026-105832
EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...
CVE-2026-107638 pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php
pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verificatio...
CVE-2026-105832 EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes
EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...
EUVD-2026-95019
EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...
CVE-2026-105832
EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...
CVE-2026-105832
EspoCRM versions before 10.0.6 are vulnerable to an authentication bypass flaw where the system accepts a login that is stopped at the second factor on routes not requiring authentication. An attacker possessing a 2FA-enabled user's credentials can bypass the second factor to access config parame...
CVE-2026-105832 EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes
EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...
CVE-2026-62142
Cross-Site Request Forgery CSRF vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0...
CVE-2026-62142 WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0...
CVE-2026-62142 WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0...
CVE-2026-62142
The Melapress WP 2FA plugin (wp-2fa) for WordPress is affected by a Cross-Site Request Forgery (CSRF) vulnerability in versions 4.1.0 and below . This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated user. The documentation does not specify the exact component...
EUVD-2026-94932
Cross-Site Request Forgery CSRF vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0...
WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Filip Kowalski in WordPress Plugin WP 2FA versions = 4.1.0...
