63 matches found
CVE-2023-40834
OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page against excessive login attempts, allowing unauthenticated attackers to gain access to the application via a brute force attack to the password parameter...
PT-2023-27662 · Unknown · Opencart Cms
Name of the Vulnerable Software and Affected Versions: OpenCart CMS version 4.0.2.2 Description: The issue is related to a lack of protection against excessive login attempts on the login page, allowing unauthenticated attackers to perform a brute force attack to gain access to the application...
PT-2023-22091 · Unknown · @Fastify/Passport +1
Name of the Vulnerable Software and Affected Versions: @fastify/passport versions prior to the version that regenerates sessionId upon login Description: Applications using @fastify/passport for user authentication, in combination with @fastify/session as the underlying session management...
CVE-2021-41171
eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header. This issue has been addressed by implementing...
CVE-2021-24194
Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then blog...
Code injection
Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then blog...
CVE-2021-24194 Login Protection - Limit Failed Login Attempts < 2.9 - Arbitrary Plugin Installation/Activation via Low Privilege User
Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then blog...
WordPress plugin Login Protection - Limit Failed Login Attempts 安全漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . WordPress plugin 2.9 prior to the version Login Protectio...
WordPress Login Protection – Limit Failed Login Attempts plugin <= 2.8 - Arbitrary Plugin Installation and Activation vulnerability
Arbitrary Plugin Installation and Activation vulnerability discovered by Bugbang in WordPress Login Protection – Limit Failed Login Attempts plugin versions = 2.8. Solution Update the WordPress Login Protection – Limit Failed Login Attempts plugin to the latest available version at least 2.9...
CVE-2020-26251
Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run...
CVE-2019-6524
Moxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to discover passwords via brute force attack...
WordPress Plugin Cerber Security_ Antispam Malware Scan 8.0 - Multiple Bypass Vulnerabilities
WordPress Plugin Cerber Security Antispam Malware Scan 8.0 - Multiple Bypass Vulnerabilities Exploit Title: WordPress Cerber Security, Antispam & Malware Scan - Multiple Bypass Vulnerabilities Type: WordPress Plugin Date: 2019-03-04 Active installs: 100,000+ Version: 8.0 Software Link:...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that have unknown impact via a crafted request to the brute-force-login-protection page to...
CVE-2014-5034
Cross-site request forgery CSRF vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that have unknown impact via a crafted request to the brute-force-login-protection page to...
CVE-2014-5034
Cross-site request forgery CSRF vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that have unknown impact via a crafted request to the brute-force-login-protection page to...
CVE-2014-5034
The CVE concerns WordPress Brute Force Login Protection plugin (version ~1.3) where a Cross-Site Request Forgery (CSRF) flaw allows remote attackers to hijack user authentication by crafting requests to the plugin’s brute-force-login-protection page (affecting wp-admin/options-general.php). Affec...
WordPress Brute Force Login Protection plugin <= 1.5.2 - Reflected Cross-Site Scripting (XSS) Vulnerability
WordPress Brute Force Login Protection plugin Reflected Cross-Site Scripting XSS vulnerability exists on the plugin’s setting page. This vulnerability occurs in the function showSettingsPage in the file /brute-force-login-protection.php. Solution Update the plugin to version 1.5.3...
Z Web Solutions CMS v5.1 - Auth Bypass Web Vulnerability
Document Title: =============== Z Web Solutions CMS v5.1 - Auth Bypass Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1864 Release Date: ============= 2016-06-28 Vulnerability Laboratory ID VL-ID: ====================================...
WordPress Brute Force Login Protection plugin <= 1.5.3 - Arbitrary IP Removal/Add via Cross-Site Request Forgery (CSRF) vulnerability
Arbitrary IP Removal/Add via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Brute Force Login Protection plugin versions = 1.5.3. Solution Deactivate and delete. This plugin has been closed as of April 7, 2022 and is not available for download. This closure is temporary,...