Blitz Panel 安全漏洞

Blitz Panel is a comprehensive administration panel for proxy servers by Whispering Wind Personal Developers. A security vulnerability exists in Blitz Panel version 1.17.0, which stems from an open redirection in the nexturl parameter in the login endpoint that could lead to phishing attacks or...

CVE-2025-60935

An open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 allows attackers to redirect users to malicious domains via a crafted URL. This issue affects the nexturl parameter in the login endpoint and could lead to phishing or token theft after successful authentication...

CVE-2025-60935

An open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 allows attackers to redirect users to malicious domains via a crafted URL. This issue affects the nexturl parameter in the login endpoint and could lead to phishing or token theft after successful authentication...

CVE-2025-60935

CVE-2025-60935 describes an open redirect in Blitz Panel v1.17.0 at the login endpoint, affecting the next_url parameter. The vulnerability can enable a user to be redirected to a malicious domain after login, with potential phishing or token theft after authentication. Multiple connected sources...

CVE-2025-60935

An open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 allows attackers to redirect users to malicious domains via a crafted URL. This issue affects the nexturl parameter in the login endpoint and could lead to phishing or token theft after successful authentication...

CVE-2023-53873

SyncBreeze 15.2.24 contains a denial of service vulnerability in the login authentication mechanism that allows attackers to crash the service. Attackers can send an oversized password parameter with repeated 'password=' values to overwhelm the login endpoint and potentially disrupt service...

CVE-2025-65427

An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to /api/login allowing attackers to brute force password enumerations...

CVE-2025-65427

The CVE-2025-65427 affects the Dbit N300 T1 Pro Easy Setup Wireless Wi‑Fi Router (firmware V1.0.0). The root cause is lack of rate limiting on the /api/login endpoint, enabling brute-force password enumeration. Documented impact: password guessing attempts are possible with network access; remedi...

PT-2025-51736

Name of the Vulnerable Software and Affected Versions Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router version V1.0.0 Description The Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router version V1.0.0 does not implement rate limiting on the /api/login endpoint. This allows attackers to attempt...

CVE-2023-53873

SyncBreeze 15.2.24 is affected by a denial-of-service in the login authentication mechanism. An attacker can overwhelm the login endpoint by sending an oversized password parameter constructed with repeated 'password=' values, potentially crashing the service and impacting availability. The provi...

CVE-2023-53873 SyncBreeze 15.2.24 Denial of Service via Login Endpoint Overflow

SyncBreeze 15.2.24 contains a denial of service vulnerability in the login authentication mechanism that allows attackers to crash the service. Attackers can send an oversized password parameter with repeated 'password=' values to overwhelm the login endpoint and potentially disrupt service...

CVE-2023-53873 SyncBreeze 15.2.24 Denial of Service via Login Endpoint Overflow

SyncBreeze 15.2.24 contains a denial of service vulnerability in the login authentication mechanism that allows attackers to crash the service. Attackers can send an oversized password parameter with repeated 'password=' values to overwhelm the login endpoint and potentially disrupt service...

CVE-2025-13390

The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdkgenerateautologinlink" function. This is due to the feature using a cryptographically weak token...

CVE-2025-13390

CVE-2025-13390 affects the WordPress plugin WP Directory Kit, versions up to 1.4.4. The flaw is an authentication bypass caused by a weak token generation in the wdk_generate_auto_login_link function, making tokens predictable and allowing unauthenticated attackers to gain administrative access a...

CVE-2025-13390 WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover

The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdkgenerateautologinlink" function. This is due to the feature using a cryptographically weak token...

CVE-2025-60736

code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter...

Incorrect Implementation of Authentication Algorithm

Overview Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm. An attacker can gain unauthorized access to another user's account by leveraging a specially crafted email address when switching authentication methods and sending a request to the...

EUVD-2025-198573

A security vulnerability has been detected in Campcodes Supplier Management System 1.0. This impacts an unknown function of the file /index.php of the component Login. Such manipulation of the argument txtUsername leads to sql injection. It is possible to launch the attack remotely. The exploit h...

CVE-2025-13485

A security flaw has been discovered in itsourcecode Online File Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=login. The manipulation of the argument Username results in sql injection. The attack may be launched remotely. The exploit has been...

CVE-2025-13485

A security flaw has been discovered in itsourcecode Online File Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=login. The manipulation of the argument Username results in sql injection. The attack may be launched remotely. The exploit has been...