CVE-2025-27845

In ESPEC North America Web Controller 3 before 3.3.4, /api/v4/auth/ with any invalid authentication request results in exposing a JWT secret. This allows for elevated permissions to the UI...

CVE-2025-27845

CVE-2025-27845 affects ESPEC North America Web Controller, versions prior to 3.3.4. An invalid authentication request to /api/v4/auth/ exposes the JWT secret, permitting elevated permissions to the UI. The CVSSv3.1 base score is 9.8 (CRITICAL). Remediation: upgrade to 3.3.4 or later (per PT-2025-...

CVE-2025-5412

A vulnerability classified as problematic has been found in Mist Community Edition up to 4.7.1. Affected is the function Login of the file src/mist/api/views.py of the component Authentication Endpoint. The manipulation of the argument returnto leads to cross site scripting. It is possible to...

GHSA-CP5V-2HMC-3VJX WSO2 is vulnerable to Open Redirect through multi-option URL in its authentication endpoint

An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site. By...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. An attacker can redirect users to an attacker-controlled site by crafting a valid link that...

CVE-2024-1440

An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site. By...

CVE-2024-1440

An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site. By...

WSO2多款产品 输入验证错误漏洞

WSO2 API Manager and others are products of WSO2, Inc. of the U.S. WSO2 API Manager is an API lifecycle management solution.WSO2 Identity Server IS is an identity server.WSO2 Identity Server as Key Manager is an identity server. A security vulnerability exists in several WSO2 products that stems...

CVE-2025-5412 Mist Community Edition Authentication Endpoint views.py login cross site scripting

A vulnerability classified as problematic has been found in Mist Community Edition up to 4.7.1. Affected is the function Login of the file src/mist/api/views.py of the component Authentication Endpoint. The manipulation of the argument returnto leads to cross site scripting. It is possible to...

CVE-2025-5412 Mist Community Edition Authentication Endpoint views.py login cross site scripting

A vulnerability classified as problematic has been found in Mist Community Edition up to 4.7.1. Affected is the function Login of the file src/mist/api/views.py of the component Authentication Endpoint. The manipulation of the argument returnto leads to cross site scripting. It is possible to...

CVE-2025-5412

CVE-2025-5412 affects Mist Community Edition up to 4.7.1. The vulnerability resides in the Login function of src/mist/api/views.py (Authentication Endpoint); manipulating the return_to argument leads to a cross-site scripting (XSS) condition. Exploitation is possible remotely, and public disclosu...

CVE-2023-6838

Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests...

CVE-2024-5962

A reflected cross-site scripting XSS vulnerability exists in the authentication endpoint of multiple WSO2 products due to missing output encoding of user-supplied input. A malicious actor can exploit this vulnerability to inject arbitrary JavaScript into the authentication flow, potentially leadi...

CVE-2024-5962 Reflected Cross-Site Scripting (XSS) in Authentication Endpoint of Multiple WSO2 Products Due to Missing Output Encoding

A reflected cross-site scripting XSS vulnerability exists in the authentication endpoint of multiple WSO2 products due to missing output encoding of user-supplied input. A malicious actor can exploit this vulnerability to inject arbitrary JavaScript into the authentication flow, potentially leadi...

CVE-2024-5962 Reflected Cross-Site Scripting (XSS) in Authentication Endpoint of Multiple WSO2 Products Due to Missing Output Encoding

A reflected cross-site scripting XSS vulnerability exists in the authentication endpoint of multiple WSO2 products due to missing output encoding of user-supplied input. A malicious actor can exploit this vulnerability to inject arbitrary JavaScript into the authentication flow, potentially leadi...

CVE-2024-5962

CVE-2024-5962 is a reflected XSS in the authentication endpoint of multiple WSO2 products (e.g., WSO2 API Manager and WSO2 Identity Server) caused by missing output encoding of user input. The vulnerability can lead to arbitrary JavaScript execution in the authentication flow, potentially modifyi...

PT-2025-22561 · Wso2 · Wso2

Name of the Vulnerable Software and Affected Versions: WSO2 products affected versions not specified Description: A reflected cross-site scripting XSS issue exists in the authentication endpoint of multiple WSO2 products due to missing output encoding of user-supplied input. This allows a malicio...

SUSE CVE-2025-27538

Mattermost versions 10.5.x = 10.5.1, 9.11.x = 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the target user ID, which allows users with editotherusers permission to activate or deactivate MFA for other users, even if those users have not...

PT-2024-31404

Name of the Vulnerable Software and Affected Versions Fides versions prior to 2.44.0 Description A timing-based username enumeration vulnerability exists in Fides Webserver authentication, allowing an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it...

meetyoucrop big-whale security breach

big-whale is a task scheduling platform open-sourced by Meiyu meetyoucrop. A security vulnerability exists in meetyoucrop big-whale version 1.1, which stems from the presence of an unknown function in /auth/user/all.api in the component Admin Module, which leads to ownership mismanagement via the...