CVE-2017-14980_syncbreeze_10.0.28_bof

漏洞利用 - CVE-2017-14980 - Sync Breeze Enterprise v10.0.28 本仓库包含一个针对 Sync Breeze Enterprise 10.0.28 版本的缓冲区溢出利用（BOF）概念验证，针对漏洞 CVE-2017-14980 。 描述 该漏洞源于在处理向 /login 端点发送的 POST 请求中的 password 字段时存在不当输入验证。 攻击者可在此字段中发送超长值，从而覆盖 EIP 并允许任意代码执行。 此漏洞利用发送精心构造的有效负载，包含： 520 字节填充（'A'） 4 字节覆盖 EIP 20 字节 NOP sled...

CVE-2026-8793

CVE-2026-8793 — Protezione brute-force mancante nel modulo di accesso di PaperCut NG Campo| Dettagli ---|--- ID CVE| CVE-2026-8793 Prodotto| PaperCut NG Versione interessata| 25.0.11 Build 75758 e precedenti CWE| CWE-307 — Limitazione impropria dei tentativi di autenticazione eccessivi Punteggio...

CVE-2026-78617

WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined...

CVE-2026-78551 RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts

RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. For local authentication, the login implementati...

CVE-2026-78551 RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts

RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. For local authentication, the login implementati...

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...

CVE-2026-76764

A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible...

PT-2026-78873

Name of the Vulnerable Software and Affected Versions code-projects Employee Management System version 1.0 Description A SQL injection flaw exists in the Admin Login Endpoint within the /process/aprocess.php file. The issue occurs when the mailuid argument is manipulated, allowing for remote...

CVE-2026-54739

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/localuser/login.rs returns different errors depending on whether the usernameoremail value exists. LocalUserView::findbyemailorname propagates a NotFound respons...

CVE-2026-54739 Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/localuser/login.rs returns different errors depending on whether the usernameoremail value exists. LocalUserView::findbyemailorname propagates a NotFound respons...

CVE-2026-54739 Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/localuser/login.rs returns different errors depending on whether the usernameoremail value exists. LocalUserView::findbyemailorname propagates a NotFound respons...

EUVD-2026-62847

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/localuser/login.rs returns different errors depending on whether the usernameoremail value exists. LocalUserView::findbyemailorname propagates a NotFound respons...

EUVD-2026-62226

A flaw has been found in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit h...

CVE-2026-76048 SourceCodester Simple Online Food Ordering System ajax.php login sql injection

A flaw has been found in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit h...

PT-2026-78674

Name of the Vulnerable Software and Affected Versions Lemmy versions prior to 0.19.19 Lemmy versions prior to 1.0.0-beta.1 Description The login endpoint in crates/api/api/src/local user/login.rs exhibits a response discrepancy based on the existence of a user account. The function...

CVE-2026-75773

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed...

EUVD-2026-60580

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed...

CVE-2026-75773 karakeep-app karakeep Login Endpoint auth.ts authorize excessive authentication

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed...

CVE-2026-75773

The vulnerability is in the authorize function of apps/web/server/auth.ts in karakeep up to 0.32.0, allowing unlimited login attempts on the remote Login Endpoint. It is rated CVSS 3.7 (LOW) with high attack complexity. Upgrading to 0.33.0 (patch f7d042971d0d2bcc7119654830cf1eb93eabbf24) resolves...

CVE-2026-19897

A vulnerability has been found in mangroup dtale up to 3.22.0. This issue affects the function Login of the file dtale/auth.py of the component Login Endpoint. Such manipulation leads to improper restriction of excessive authentication attempts. The attack can be executed remotely. This attack is...