CVE-2025-46521 WordPress WS Force Login Page <= 3.0.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Silver Muru WS Force Login Page allows Stored XSS. This issue affects WS Force Login Page: from n/a through 3.0.3...

CVE-2025-46521

CVE-2025-46521 concerns the WordPress plugin "WS Force Login Page". The vulnerability is a cross‑site scripting (stored XSS) flaw caused by improper input neutralization, affecting versions from n/a up to and including 3.0.3. Public references in the provided documents corroborate stored XSS as t...

WordPress plugin WS Force Login Page 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-17825 · Unknown · Silver Muru Ws Force Login Page

Name of the Vulnerable Software and Affected Versions: Silver Muru WS Force Login Page versions n/a through 3.0.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2025-17529 · Unknown · Bruteguard

Name of the Vulnerable Software and Affected Versions: BruteGuard – Brute Force Login Protection versions 0.1.4 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability. This allows for...

PT-2025-17337 · Seclore · Seclore

Name of the Vulnerable Software and Affected Versions: Seclore version 3.27.5.0 Description: An issue in the login page of Seclore allows attackers to bypass authentication via a brute force attack. Recommendations: For version 3.27.5.0, consider temporarily restricting access to the login page...

CVE-2022-3741

Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output...

CVE-2024-11178

The Login With OTP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.4.2. This is due to the plugin generating too weak OTP, and there’s no attempt or time limit. This makes it possible for unauthenticated attackers to generate and brute force the...

CVE-2024-51558

This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user OTP, MPIN or password, which could lead to gain...

Red Hat Keycloak 安全漏洞

Red Hat Keycloak is a suite of software from Red Hat USA that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak version 24.0.3 and prior versions. An attacker could use this vulnerability to brute-force...

SevOne Network Performance Management Application Brute Force Login Utility

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SevOne Network Performance Management Application Brute Force Login Utility', 'Description' = % This module scans for SevOne Network Performance...

PT-2024-10884 · Netiq · Netiq Advance Authentication

Name of the Vulnerable Software and Affected Versions: NetIQ Advance Authentication versions prior to 6.3.5.1 Description: A vulnerability identified in NetIQ Advance Authentication does not enforce account lockout when a brute force attack is performed on API-based login. This issue may lead to...

GHSA-C69X-5XMW-V44X CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability

Summary Here it is observed that the CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. Details The web application lacks control over the login attempts i.e. why attacker can use a password brute force attack to find and get full access...

Topkapi Security Vulnerability

AREAL Topkapi is a software platform from AREAL. A security vulnerability exists in Topkapi Webserv2 6.2.4776 and earlier versions, which originates from a brute force login attack that can cause a temporary denial of service to a website...

CVE-2023-42480

The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids. This will have an impact on confidentiality but there is no other impact on integrity or availability...

CVE-2023-41350

Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient measures to prevent multiple failed authentication attempts. An unauthenticated remote attacker can execute a crafted Javascript to expose captcha in page, making it very easy for bots to bypass the captcha check and more...

Uvdesk Security Breach

Uvdesk is a complete ticket support system open source by Uvdesk India. A security vulnerability exists in Uvdesk v1.1.1. An attacker exploits the vulnerability to perform a brute force attack on the login page to gain access to the application...

PT-2023-25220 · Iq Wifi 6 · Iq Wifi 6

Name of the Vulnerable Software and Affected Versions: IQ Wifi 6 versions prior to 2.0.2 Description: An unauthorized user could gain account access by conducting a brute force authentication attack. Recommendations: For IQ Wifi 6 versions prior to 2.0.2, update to version 2.0.2 or later to resol...

Siemens CP-8031 安全漏洞

The SICAM A8000 RTUs Remote Terminal Units series is a modular device family for remote control and automation applications in all areas of energy supply. A security vulnerability exists in the Siemens SICAM A8000 Devices CPCI85 Firmware, which can be exploited by an attacker to attempt to...

CVE-2023-2257

Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access to the user interface to unlock a Hub Business space without being prompted to enter the password via an unimplemented "Force Login" securi...