hacker-scripts

Hacker Scripts 根据 真实故事 改编: xxx: 是这样的，我们的构建工程师离职去了另外一家公司，这货基本算是生活在终端里。 你知道么，这人热爱Vim，用Dot作图，甚至用MarkDown来写维基帖子...，如果有什么事情要花上他超过90秒，他一定会整个脚本来让这件事变得“自动化”。 xxx: 我们现在坐在他的工位上，看着他留下来的这些，呃，“遗产”？ xxx: 我觉得你们会喜欢这些的 xxx: smack-my-bitch-up.sh拍老婆马屁脚本 -...

CVE-2026-35597

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-attempt lockout mechanism is non-functional due to a database transaction handling bug. When a TOTP validation fails, the login handler in pkg/routes/api/v1/login.go calls HandleFailedTOTPAuth and then...

CVE-2026-35597

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-attempt lockout mechanism is non-functional due to a database transaction handling bug. When a TOTP validation fails, the login handler in pkg/routes/api/v1/login.go calls HandleFailedTOTPAuth and then...

CVE-2026-35597

Vikunja prior to 2.3.0 is vulnerable to TOTP brute-forcing because the login failure path writes the account lock status (StatusAccountLocked) on the same DB session that is rolled back after a failed TOTP check. The in-memory counter in HandleFailedTOTPAuth tracks failures, and once it reaches 1...

CVE-2026-35597 Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-attempt lockout mechanism is non-functional due to a database transaction handling bug. When a TOTP validation fails, the login handler in pkg/routes/api/v1/login.go calls HandleFailedTOTPAuth and then...

Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout

Summary The TOTP failed-attempt lockout mechanism is non-functional due to a database transaction handling bug. The account lock is written to the same database session that the login handler always rolls back on TOTP failure, so the lockout is triggered but never persisted. This allows unlimited...

GHSA-FGFV-PV97-6CMJ Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout

Summary The TOTP failed-attempt lockout mechanism is non-functional due to a database transaction handling bug. The account lock is written to the same database session that the login handler always rolls back on TOTP failure, so the lockout is triggered but never persisted. This allows unlimited...

PT-2026-31948

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.3.0 Description A flaw exists in Vikunja before version 2.3.0 related to the Time-based One-Time Password TOTP failed-attempt lockout mechanism. A database transaction handling bug prevents the account lockout from...