Art-in Wi-Fi Cloud Hotspot 安全漏洞

Art-in Wi-Fi Cloud Hotspot is a cloud WiFi hotspot device from Art-in Turkey. A security vulnerability exists in Art-in Wi-Fi Cloud Hotspot versions prior to 30.05.2025, which stems from improperly restricted authentication attempts and could lead to authentication abuse or bypass...

CVE-2024-48872

Mattermost versions 10.1.x = 10.1.2, 10.0.x = 10.0.2, 9.11.x = 9.11.4, and 9.5.x = 9.5.12 fail to prevent concurrently checking and updating the failed login attempts. which allows an attacker to bypass of "Max failed attempts" restriction and send a big number of login attempts before being...

CVE-2019-17205

TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed...

The vulnerability of the FortiOS operating system in the FortiGate 200F network firewall allows a attacker to execute a brute-force attack.

The vulnerability of the FortiOS operating system for the FortiGate 200F network firewall is related to the absence of mechanisms for controlling the number of password input attempts. Exploiting this vulnerability allows a malicious actor to carry out an attack using brute-force methods...

CVE-2024-56476

IBM TXSeries for Multiplatforms 9.1 and 11.1 could allow an attacker to enumerate usernames due to an observable login attempt response discrepancy...

CVE-2024-56476

IBM TXSeries for Multiplatforms 9.1 and 11.1 could allow an attacker to enumerate usernames due to an observable login attempt response discrepancy...

CVE-2025-23568

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fredsted WP Login Attempt Log wp-login-attempt-log allows Reflected XSS.This issue affects WP Login Attempt Log: from n/a through = 1.3...

CVE-2025-23568 WordPress WP Login Attempt Log plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fredsted WP Login Attempt Log wp-login-attempt-log allows Reflected XSS.This issue affects WP Login Attempt Log: from n/a through = 1.3...

CVE-2025-23568

CVE-2025-23568 is a Reflected XSS in the WordPress plugin WP Login Attempt Log (versions up to 1.3). The root cause is improper neutralization of input during web page generation, enabling reflected script execution. Impact per sources: potential confidentiality and integrity exposure, with low a...

WordPress plugin WP Login Attempt Log 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

The vulnerability of the server console for managing Fortinet FortiClient Enterprise Management Server programs allows a perpetrator to execute a brute-force attack.

The vulnerability of the server console for managing Fortinet FortiClient Enterprise Management Server EMS is related to the lack of authentication attempt limits. Exploiting this vulnerability allows a malicious actor to execute a brute-force attack remotely...

WordPress WP Login Attempt Log plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin WP Login Attempt Log versions = 1.3...

CVE-2024-48872

Mattermost server CVE-2024-48872 affects 9.5.x (up to 9.5.12), 9.11.x (up to 9.11.4), 10.0.x (up to 10.0.2), and 10.1.x (up to 10.1.2). The issue is a race condition where concurrent login attempts are not prevented from updating the failure counter, allowing an attacker to bypass the Max failed ...

389-ds-base: Malformed userPassword hash may cause Denial of Service

A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password...

UBUNTU-CVE-2024-39917

xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configuration parameter MaxLoginRetry in /etc/xrdp/sesman.ini. However, this...

Improper Authentication Limits

wwbn/avideo is vulnerable to Improper Authentication Limits. The vulnerability is due to a lack of login attempt restrictions. An attacker can send a specially crafted HTTP request which leads to a captcha bypass. This allows the attacker to brute force the user credentials...

CVE-2023-49810

Summary (validated from provided sources) : CVE-2023-49810 affects WWBN AVideo (dev master commit 15fed957fb). A weakness in checkLoginAttempts can bypass the captcha protection, enabling brute-force login attempts via a sequence of HTTP requests. Talos confirms the vulnerability in the login flo...

CVE-2023-49810

A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to brute force user credentials. An attacker can send a seri...

WWBN AVideo Security Breach

WWBN AVideo is a video platform builder written in PHP by the WWBN team. A security vulnerability exists in WWBN AVideo, which stems from a login attempt limit bypass vulnerability in the checkLoginAttempts method...

CVE-2023-4094

ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block each legitimate account and cause a denial of service. In addition, a resource has been identified that could allow circumventing the attempt limit set in the...