CVE-2026-93616_Checks

Installation Move compromise-check.sh to Check Point Management server chmod +x compromise-check.sh Shell Script Run these commands in Expert mode on the Check Point management server, from the directory containing compromise-check.sh. SmartDashboard Script smartdashboardrunscript.sh can simply b...

UhOh365

UhOh365 A script that can see if an email address is valid in Office365. This does not perform any login attempts, is unthrottled, and is incredibly useful for social engineering assessments to find which emails exist and which don't. Microsoft does not consider "email enumeration" a vulnerabilit...

Limit Login Attempts WordPress - Stored Cross-site Scripting

Limit Login Attempts WordPress plugin 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context. id: CVE-2021-24657 info: name:...

Limit Login Attempts - Stored Cross-Site Scripting

Limit Login Attempts WordPress plugin 4.0.72 contains a stored cross-site scripting caused by unsanitized and unescaped settings, letting malicious administrators inject Javascript code, exploit requires administrator privileges. id: CVE-2022-1029 info: name: Limit Login Attempts - Stored...

CVE-2024-13184

CVE-2024-13184 The Ultimate WordPress Toolkit – WP Extended = 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module Description The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to time-based SQL Injection via the Login Attempts module in all versions ...

CVE-2023-4800

CVE ID: CVE-2023-4800 Vulnerability Type: Sensitive Data Exposure Description: The DoLogin Security plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dashboard widget in versions up to, and including, 3.7. This makes it possible for...

CVE-2020-35590

Exploit Information Exploit Title: WordPress Plugin Limit Login Attempts Reloaded 2.13.0 - Login Limit Bypass CVE: CVE-2020-35590 Date: 2020-06-09 Exploit Author: N4nj0 Software Link: https://wordpress.org/plugins/limit-login-attempts-reloaded/ Version: 2.13.0 Tested on: WordPress 5.4.1, 5.4.2...

CVE-2024-34070

CVE-2024-34070 Froxlor PoC Python proof of concept for CVE-2024-34070, a stored XSS issue in Froxlor before 2.1.9 through failed login attempts written to the system log. WARNING This project is for authorized security testing, CTF labs, and educational use only. Do not run this against systems y...

CVE-2026-118439

The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones SSRF...

WordPress Limit Login Attempts Security plugin < 3.4.2 - Admin+ SSRF vulnerability

Admin+ SSRF vulnerability discovered by Viktor Heiduck in WordPress Plugin Limit Login Attempts Reloaded versions 3.4.2...

CVE-2026-118439 Limit Login Attempts Reloaded < 3.4.2 - Admin+ SSRF via App Setup Code

The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones SSRF...

CVE-2026-118439

The Limit Login Attempts Security WordPress plugin (versions before 3.4.2 ) is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is a lack of validation for the destination of a server-side request constructed from a user-supplied setup value. This allows users with administrato...

EUVD-2026-123176

The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones SSRF...

CVE-2026-118439: Unknown Limit Login Attempts Security: The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side…

The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones SSRF...

PT-2026-145012

The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones SSRF...

CVE-2026-112205

WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the logincount and logintimeout cookies, allowing an unauthenticated attacker to perform an unlimited number of login attempts. This issue has been fixed in...

CVE-2026-112205

WidzialniCMS is vulnerable to a Bruteforce Protection Bypass in its login functionality. The root cause is that the cookie-based lockout mechanism can be bypassed by an unauthenticated attacker who omits the login_count and login_timeout cookies. This allows the attacker to perform an unlimited n...

WordPress Limit Login Attempts Security plugin < 3.4.1 - Two-Factor Authentication Bypass vulnerability

Two-Factor Authentication Bypass vulnerability discovered by Qi Qin in WordPress Plugin Limit Login Attempts Reloaded versions 3.4.1...

WordPress Limit Login Attempts Security plugin < 3.4.1 - Two-Factor Authentication Bypass vulnerability

Two-Factor Authentication Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Limit Login Attempts Reloaded versions 3.4.1...

CVE-2026-118201

The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access...