Lucene search
+L

173095 matches found

NVD
NVD
added 2026/08/28 8:16 a.m.12 views

CVE-2026-76581

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

9.8CVSS0.00339EPSS
SaveExploits2References2
Cvelist
Cvelist
added 2026/08/28 6:39 a.m.41 views

CVE-2026-76581 WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

9.8CVSS0.00339EPSS
SaveExploits2References2
CVE
CVE
added 2026/08/28 6:39 a.m.106 views

CVE-2026-76581

CVE-2026-76581 is a Critical (CVSS 9.8) unauthenticated Authentication Bypass in the WPMU DEV Dashboard plugin for WordPress (≤ 5.0.1 , ~350,000 installs). The root cause is HMAC canonicalization confusion between two unauthenticated AJAX actions: wdpsso_step1 signs an unseparated concatenation o...

9.8CVSS5.8AI score0.00339EPSS
SaveIn wildExploits2References2
EUVD
EUVD
added 2026/08/28 6:39 a.m.8 views

EUVD-2026-67464

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

9.8CVSS5.8AI score0.00339EPSS
SaveExploits2References2
Kitploit
Kitploit
added 2026/08/28 6:34 a.m.4 views

CVE-2023-27100

CVE-2023-27100 - pfSense Umgehung des Anti-Brute-Force-Schutzes Problembeschreibung Das Authentifizierungssystem versucht, informativ zu sein und zusätzliche Informationen zusammen mit IP-Adressen auszugeben, um vollständig zu identifizieren, von wo aus sich ein Benutzer anmeldet, wenn er sich üb...

9.8CVSS7.3AI score0.09844EPSS
SaveExploits5
EUVD
EUVD
added 2026/08/28 6:11 a.m.10 views

EUVD-2026-67578

SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...

5.4CVSS6.1AI score0.00169EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/28 6:10 a.m.26 views

CVE-2026-73827

SOY Calendar is affected by a cross-site scripting (XSS) vulnerability that allows an arbitrary script to be executed in the web browser of a user who is logging into the product. The vulnerability requires low privileges and active user interaction , with a CVSS 3.0 base score of 5.4 (MEDIUM) an...

5.4CVSS6.1AI score0.00169EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/08/28 5:07 a.m.4 views

CVE-2026-41940

CVE-2026-41940 — cPanel2Shell Interaktives Ausnutzungstool für CVE-2026-41940 🧠 Was ist CVE-2026-41940 ? cPanel2Shell nutzt eine kritische Schwachstelle zur Authentifizierungsumgehung in cPanel & WHM aus. Die Schwachstelle wird durch eine CRLF-Injection im Login-/Session-Handling-Mechanismus...

9.8CVSS7.5AI score0.98527EPSS
SaveExploits74
EUVD
EUVD
added 2026/08/28 12:32 a.m.6 views

EUVD-2026-67289

The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality...

8.7CVSS5.3AI score0.00364EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/28 12:32 a.m.6 views

EUVD-2026-67285

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

8.7CVSS5.3AI score0.00357EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/28 12:32 a.m.6 views

EUVD-2026-67294

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to...

9.8CVSS5.6AI score0.00674EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/28 12:32 a.m.7 views

EUVD-2026-67283

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session informati...

9.8CVSS5.4AI score0.00434EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/28 12:32 a.m.7 views

EUVD-2026-67295

Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default credentials remain configured. An unauthenticated attacker on the adjacent network could reboot the device or restore factory settings,...

8.1CVSS5.3AI score0.00229EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/28 12:32 a.m.8 views

EUVD-2026-67282

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device...

9.8CVSS5.3AI score0.00521EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/28 12:32 a.m.6 views

EUVD-2026-67277

Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability...

9.8CVSS5.2AI score0.0053EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/28 12:18 a.m.10 views

CVE-2026-76945

The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality...

8.7CVSS0.00364EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/28 12:18 a.m.10 views

CVE-2026-76943

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to...

9.8CVSS0.00674EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/28 12:18 a.m.10 views

CVE-2026-76940

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

8.7CVSS0.00357EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/28 12:18 a.m.9 views

CVE-2026-77977

Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default credentials remain configured. An unauthenticated attacker on the adjacent network could reboot the device or restore factory settings,...

8.1CVSS0.00229EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/28 12:18 a.m.11 views

CVE-2026-76179

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session informati...

9.8CVSS0.00434EPSS
SaveExploits0References2
Rows per page
Query Builder