EUVD-2005-2490

Malware in sbrugna...

EUVD-2019-2075

Malware in sbrugna...

EUVD-2024-54066

Malicious code in bioql PyPI...

PT-2025-35801

Name of the Vulnerable Software and Affected Versions: Quest One Identity version 7.5.1.20903 Description: A crafted response manipulation can bypass the One-Time Password OTP on the Multi-Factor Authentication MFA page, leading to unauthorized access to the Privileged Access Management PAM porta...

CVE-2025-27929

Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts...

CVE-2025-27929

Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts...

Scratch-Coding-Hut 安全漏洞

Scratch-Coding-Hut is a coding website open-sourced by Scratch Coding Hut. A security vulnerability exists in Scratch-Coding-Hut 1.0-beta3 and earlier versions, which stems from a login link that can be used to log in to arbitrary accounts...

WordPress plugin WP Real Estate Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-8485

The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and including, 4.7.1 via the updateUserInfo due to missing validation on the 'openid' user controlled key that determines what user will be updated. This makes it...

Ruby On Rails Devise Authentication Password Reset

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rexml/element' class MetasploitModule 'Ruby on Rails Devise Authentication Password Reset', 'Description' = %q The Devise authentication gem for Ruby on Rails i...

WebITR Trust Management Issues Vulnerabilities

WebITR is an online time and attendance system. WebITR version 21023 suffers from a trust management issue vulnerability that stems from the use of hard-coded encryption keys, which can be exploited by a remote attacker to generate valid token parameters, access the system with an arbitrary user...

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores lies in the lack of authentication mechanisms. This allows attackers to access information about arbitrary user accounts.

The vulnerability of the Magento Open Source and Adobe Commerce software platforms for developing and managing online stores is related to deficiencies in authentication mechanisms. Exploiting this vulnerability could allow a malicious actor to access and disclose information about arbitrary user...

Cross site request forgery (csrf)

The Lock User Account WordPress plugin through 1.0.3 does not have CSRF check when bulk locking and unlocking accounts, which could allow attackers to make logged in admins lock and unlock arbitrary users via a CSRF attack...

CVE-2023-2781

The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticateuserbyemail in versions up to, and including, 3.5.0. This is due to a random token generation weakness in the resendverificationemail function. This allows unauthenticated...

Authentication flaw

The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticateuserbyemail in versions up to, and including, 3.5.0. This is due to a random token generation weakness in the resendverificationemail function. This allows unauthenticated...

User Email Verification for WooCommerce <= 3.5.0 - Authentication bypass via weak token generation

The plugin uses a weak random token when resending email address verifications, allowing an unauthenticated attacker to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts. Furthermore, if the Allow Automatic Login After Successful...

PT-2023-16491 · Unknown · Orangescrum

Name of the Vulnerable Software and Affected Versions: OrangeScrum version 2.0.11 Description: The issue allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type...

SUSE CVE-2007-4569

backend/session.c in KDM in KDE 3.3.0 through 3.5.7, when autologin is configured and "shutdown with password" is enabled, allows remote attackers to bypass the password requirement and login to arbitrary accounts via unspecified vectors...

SUSE CVE-2010-4568

Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not properly generate random values for cookies and tokens, which allows remote attackers to obtain access to arbitrary accounts via unspecified vectors,...

SUSE CVE-2019-18192

GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365...