CVE-2026-15210

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...

WordPress WooCommerce - Social Login plugin <= 2.8.7 - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass vulnerability

WordPress WooCommerce - Social Login plugin = 2.8.7 - Social Login = 2.8.7 - Unauthenticated Authentication Bypass vulnerability discovered by Rafie Muhammad in WordPress Plugin WooCommerce Social Login versions = 2.8.7...

CVE-2026-71213

Typemill's login endpoint POST /tm/login, ControllerWebAuth::login performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account,...

EUVD-2026-53210

Typemill's login endpoint POST /tm/login, ControllerWebAuth::login performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account,...

CVE-2026-71213

CVE-2026-71213 (typemill) : The login endpoint POST /tm/login (ControllerWebAuth::login()) has no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled (default). An unauthenticated attacker can perform unlimited password-guessing against any account, including admin...

CVE-2026-71213 typemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force

Typemill's login endpoint POST /tm/login, ControllerWebAuth::login performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account,...

CVE-2026-71213 typemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force

Typemill's login endpoint POST /tm/login, ControllerWebAuth::login performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account,...

CVE-2026-71213 typemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force

Typemill's login endpoint POST /tm/login, ControllerWebAuth::login performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account,...

EUVD-2026-53204

The Stock-Inventory-Management-System application's login.php assigns raw $POST username/password values to $SESSION and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. An unauthenticated remote attacker can...

CVE-2026-71207

The Stock-Inventory-Management-System application's login.php assigns raw $POST username/password values to $SESSION and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. An unauthenticated remote attacker can...

CVE-2026-71207 Stock-Inventory-Management-System - Unauthenticated SQL Injection and Hardcoded Credentials in login.php Enable Full Authentication Bypass

The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded...

CVE-2026-71207

The Stock-Inventory-Management-System is affected in login.php, where raw $_POST values are assigned to $_SESSION and concatenated into a SQL query without parameterization, enabling unauthenticated SQL injection. An attacker could bypass authentication by submitting payloads like ' OR '1'='1, le...

CVE-2026-71207 Stock-Inventory-Management-System - Unauthenticated SQL Injection and Hardcoded Credentials in login.php Enable Full Authentication Bypass

The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded...

CVE-2026-71205 changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force

changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout no rate-limiting library is present in requirements.txt...

CVE-2026-71205 changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force

changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout no rate-limiting library is present in requirements.txt...

CVE-2026-71205

The CVE-2026-71205 issue affects changedetection.io: the /login endpoint authenticates against a single shared password using PBKDF2-HMAC-SHA256 with no per-IP or per-session rate limiting, no failed-attempt counter, and no lockout. This effectively provides unlimited brute-force opportunities, a...

CVE-2026-71205 changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force

changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout no rate-limiting library is present in requirements.txt...

Multiple vulnerabilities in NetKids iMark

Overview NetKids iMark provided by Integrated Systems Technologies, Inc. contains multiple vulnerabilities listed below: Uncontrolled search path element CWE-427 - CVE-2026-66344 Unquoted search path or element CWE-428 - CVE-2026-66839 Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported...

CVE-2026-15372

The WP 2FA WordPress plugin, in versions prior to 4.1.0 , contains an improper authentication vulnerability. The flaw exists because the plugin fails to validate the second authentication factor when specific supported methods are selected during login. An attacker who possesses a user's password...

CVE-2026-15210 Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...