9 matches found
CVE-2026-129469
The software course-tencent-cloud prior to version 2.0.2 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. The flaw exists in the /api/refund/confirm endpoint, where unauthenticated attackers can view other users' refund previews by supplying an order serial number (sn)....
CVE-2026-111675
Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can...
CVE-2026-111675 Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover
Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can...
EUVD-2026-102966
Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can...
CVE-2026-111675
The Course-tencent-cloud application (through version 2.0.1 ) is vulnerable to an improper restriction of authentication attempts (CWE-307). The vulnerability allows unauthenticated attackers to brute force 6-digit SMS or email verification codes because these codes are never invalidated or limit...
CVE-2026-111675 Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover
Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can...
CVE-2026-111675 Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover
Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can...
CVE-2026-111675: Improper Restriction of Excessive Authentication Attempts
Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can...
PT-2026-116074
šØ CVE-2026-111675 Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's...