CVE-2026-77770

The miniOrange 2FA WordPress plugin (versions before 6.3.1 and before 19.3 ) is vulnerable to unauthenticated arbitrary option deletion . The root cause is the lack of a validated transaction before deleting site options based on unauthenticated request input. An attacker can exploit this by send...

EUVD-2026-75262

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo...

OpenProject 安全漏洞

OpenProject is an open-source web-based project management software. Versions of OpenProject prior to 17.0.2 had security vulnerabilities, which stemmed from lack of permission checks. These vulnerabilities could potentially lock out application administrators...

CVE-2025-60772: Improper Authentication

Improper authentication in the web-based management interface of NETLINK HG322G V1.0.00-231017, allows a remote unauthenticated attacker to escalate privileges and lock out the legitimate administrator via crafted HTTP requests...

CVE-2025-2168

CVE-2025-2168 affects the Ultimate Store Kit – Elementor Addons, WooCommerce Builder, EDD Builder, and related widgets for WordPress, up to and including version 2.4.1. The root cause is missing or incorrect nonce validation in the dismiss() function, enabling CSRF that can allow unauthenticated ...

CVE-2006-4312: Undefined Security Weakness

Cisco PIX 500 Series Security Appliances and ASA 5500 Series Adaptive Security Appliances, when running 7.0x up to 7.05 and 7.1x up to 7.12.4, and Firewall Services Module FWSM 3.1x up to 3.11.6, causes the EXEC password, local user passwords, and the enable password to be changed to a "non-rando...

Business Objects WebIntelligence DoS

It's possible to lock out administrator's account with unsuccessfull authentication attempts...

CVE-2001-1340

Beck GmbH IPC@Chip TelnetD service is affected. The TelnetD accepts only a single connection and does not disconnect a user who does not complete login, enabling an attacker to lock out the administrator by remaining idle at a login prompt. This vulnerability stems from a missing login timeout an...