WordPress Redux Framework <=4.2.11 - Information Disclosure

WordPress Redux Framework plugin through 4.2.11 is susceptible to information disclosure. The plugin registers several unique AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php. These are predictable, given that they are based on an md5 has...

CVE-2017-14262

SamsungNVRvul CVE-2017-14262 xfuturesec Co., Ltd D'abord, obtenez le mot de passe hashé MD5 du compte 'admin'. Envoyez : GET http://192.168.1.14/cgi-bin/main-cgi?json="cmd":201,"szUserNameQry":"admin","szUserName":"","u32UserLoginHandle":0 HTTP/1.1 Host: 192.168.1.14 User-Agent: Mozilla/5.0 Windo...

xpl-ModernWMS-CVE-2024-57698

एडमिन MD5 पासवर्ड हैश प्रकटीकरण - ModernWMS v1.0 - CVE-2024-57698 modernwms v.1.0 में एक समस्या हमलावर को प्रमाणीकरण के बिना, प्रारंभिक कॉन्फ़िगरेशन और पासवर्ड परिवर्तन के बाद भी, व्यवस्थापक पासवर्ड के MD5 हैश और अन्य विशेषताओं को देखने की अनुमति देती है। ऐसा सूचना के अत्यधिक प्रदर्शन और...

CVE-2025-63666

CVE-2025-63666 — Tenda AC15 Zusammenfassung Die Tenda AC15 Firmware V15.03.05.18multi stellt ein Authentifizierungs-Cookie in der Form password= aus und gibt es ohne HttpOnly-, Secure- oder SameSite-Flags zurück, wodurch der Passwort-Hash für den Client sichtbar wird. Das niederentropische Suffix...

hassh

"HASSH" - SSH क्लाइंट और सर्वर के लिए एक प्रोफ़ाइलिंग विधि। "HASSH" एक नेटवर्क फ़िंगरप्रिंटिंग मानक है जिसका उपयोग विशिष्ट क्लाइंट और सर्वर SSH कार्यान्वयनों की पहचान करने के लिए किया जा सकता है। फ़िंगरप्रिंट्स को MD5 फ़िंगरप्रिंट के रूप में आसानी से संग्रहीत, खोजा और साझा किया जा सकता है। HASSH ...

CVE-2025-66956

CVE-2025-66956 Eine unsichere Zugriffskontrolle in den Komponenten Contact Plan, E-Mail, SMS und Fax in Asseco SEE Live 2.0 ermöglicht Remote-Angreifern, über eine berechenbare URL auf Anhänge zuzugreifen und diese auszuführen. CVSS-Vektoren CVSS 3.1: 9.8,...

hassh

"HASSH" - un metodo di profilazione per client e server SSH. NOTA: questo repository Corelight è stato creato affinché possa essere mantenuto attivamente, su richiesta di Salesforce, il cui repository originale non viene più mantenuto. "HASSH" è uno standard di fingerprinting di rete che può esse...

CVE-2022-45599

CVE-2022-45599 URL CVE:| https://vulners.com/cve/CVE-2022-45599 ---|--- Segnalato da:| TanYeeTat Prodotto:| Aztech WMB250AC Router Mesh Wireless Firmware interessato:| Rilascio 2020 topaz-linux.lzma.img Download firmware:| codice chiuso Manuale del prodotto: https://kylaconnect.com/download-cente...

CVE-2019-9053

CVE-2019-9053 Codice migliorato dell'exploit di SQL Injection di Daniele Scanu Modifiche apportate: Aggiunta variabile di controllo del timeout -t o --time che permette all'utente di estendere la temporizzazione dell'SQL injection utile se una connessione di rete tra gli host è soggetta a ritardi...

CVE-2021-3831

Script PHP Exploit CVE-2021-3831 Panoramica Questo script PHP è progettato per interagire con un sito web target generando specifici hash MD5 ed effettuando richieste HTTP per sfruttare potenziali vulnerabilità. È destinato a scopi educativi e dovrebbe essere utilizzato solo in ambienti in cui si...

AntiWeb_testing-Suite

ICS/OT AntiWeb: Testing Suite Introduzione Una vulnerabilità è stata trovata nelle applicazioni web associate a ICS/OT che girano su server Anti-Web fino alla versione 3.8.7. Le vulnerabilità che sono state identificate colpiscono diversi produttori di rinomata fama nel settore dell'automazione d...

CVE-2026-70557 diboot-core Authenticated Arbitrary Field Read via loadRelatedData Discloses Password Hashes and Salts

diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck, returns true unconditionally, so any authenticated...

GHSA-JH6H-V6MP-H22V milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery

A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown code of the file internal/metastore/kv/rootcoord/kvcatalog.go of the component Grantee ID Hash Handler. The manipulation leads to use of weak hash. The attack needs to be performed locally. The...

CVE-2026-42155 Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs

Magento Long Term Support LTS is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, the XML-RPC / SOAP API session ID is generated using an outdated, time-based...

GHSA-2CWR-GCF9-PVXR Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs

Affected Version: OpenMage LTS ≤ 20.16.0 confirmed on 20.16.0 Affected File: https://github.com/OpenMage/magento-lts/blob/main/app/code/core/Mage/Api/Model/Session.php – start method Summary The XML-RPC / SOAP API session ID is generated using an outdated, time-based construction rather than a...

CVE-2026-7103

A vulnerability was determined in code-projects Chat System 1.0. Affected is an unknown function of the file updateuser.php of the component MD5 Hash Handler. This manipulation of the argument Password causes use of weak hash. The attack is possible to be carried out remotely. The attack's...

EUVD-2026-24137

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can access diagnostic and system tools that should be restricted to administrators. The /system/cron endpoint relies on a static MD5 hash derived from the APPKEY, which is exposed i...

PT-2026-33992

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can access diagnostic and system tools that should be restricted to administrators. The /system/cron endpoint relies on a static MD5 hash derived from the APP KEY, which is exposed ...

CVE-2026-23958

Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as the JWT signing secret. This deterministic secret derivation allows an attacker to brute-force the admin’s password by exploiting unmonitored API endpoints...

CVE-2020-10539

An issue was discovered in Epikur before 20.1.1. The Epikur server contains the checkPasswort function that, upon user login, checks the submitted password against the user password's MD5 hash stored in the database. It is also compared to a second MD5 hash, which is the same for every user aka a...