CVE-2025-4094-POC

वर्डप्रेस प्लगिन Digits OTP बायपास CVE-2025-4094 अवलोकन यह स्क्रिप्ट वर्डप्रेस प्लगिन Digits संस्करण -p -i OPTIONS तर्क -u, --url: आवश्यक लक्षित URL जैसे, https://example.com/wp-admin/admin-ajax.php -p, --phone: आवश्यक लक्षित फ़ोन नंबर केवल अंक -i, --instance-id: आवश्यक इंटरसेप्टेड अनुरोध से...

CVE-2026-7671

CVE-2026-7671 - Tornet Scooter OTP Brute Force Zusammenfassung Unzureichende Begrenzung übermäßiger Authentifizierungsversuche CWE-307 in der Tornet Scooter Mobile App 4.75 auf Android. Details Der /TwoFactor-Endpunkt implementiert kein Rate Limiting oder Lockout. Eine 4-stellige OTP 0000-9999 ka...

CVE-2025-56224

CVE-2025-56224 OTP Bypass della verifica Descrizione un attaccante può impersonare il numero di cellulare di un altro utente e utilizzare questa vulnerabilità per verificare il numero senza conoscere il codice OTP. Punteggio CVSS: 8.1 Alto Tipo di attacco Remoto Autenticato Versioni interessate...

CVE-2025-4094

CVE-2025-4094 – Plugin Digits WordPress 8.4.6.1 - Bypass de Autenticação OTP Autor: Saleh Tarawneh ID CVE: CVE-2025-4094 Gravidade: Crítica CVSS 9.8 Status: Corrigido na versão 8.4.6.1 Descrição da Vulnerabilidade O plugin Digits WordPress anterior à versão 8.4.6.1 é vulnerável a ataques de força...

CVE-2025-10658

Exploit: Brute Force dell'OTP Guest di SupportCandy → Account Takeover 1 Avvia il flusso di login OTP browser Apri: root@kitploit: /support/ Seleziona login guest / OTP Inserisci l'email obiettivo es. [email protected] Invia 2 Estrai i valori richiesti dal modulo OTP Nella risposta di DevToo...

CVE-2026-57867

CVE-2026-57867 affects MicroRealEstate before or up to 1.0.0-alpha3, due to a lack of token state management that enables adversaries to bypass authentication and brute‑force One‑Time Passwords (OTP) to log in as any user. The root cause is insufficient token state handling, leading to an auth by...

CVE-2026-56450 AIL Framework - Missing Rate Limiting Enables Brute-Force Attacks Against Two-Factor Authentication Codes

AIL did not restrict repeated failed attempts to verify a two-factor authentication OTP code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an unlimited number of OTP guesses. This could enable...

CVE-2026-8760 Login with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force

The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for CVE-2024-11178: the rate-limit/lockout check added to otplloginaction was placed only inside the OTP-generation branch and is never...

CVE-2026-8760 Login with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force

The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for CVE-2024-11178: the rate-limit/lockout check added to otplloginaction was placed only inside the OTP-generation branch and is never...

CVE-2025-7630 OTP Password Brute Forcing in DorukNet's Wispotter

Improper Restriction of Excessive Authentication Attempts, Improper Authentication vulnerability in Doruk Communication and Automation Industry and Trade Inc. Wispotter allows Password Brute Forcing, Brute Force. This issue affects Wispotter: from 1.0 before v2025.10.08.1...

CVE-2025-14002

The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak OTP One-Time Password generation using only 6 numeric digits combined with a 10-minute validity window and no rate limiting on verificatio...

EUVD-2024-49847

Malicious code in bioql PyPI...

CVE-2025-10658

The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.3.7. This is due to missing rate limiting on the OTP verification for guest login. This makes it possible for unauthenticated attackers ...

WordPress Digits Plugin 8.4.6.1 - Authentication Bypass via OTP Bruteforcing

Exploit Title: WordPress Digits Plugin 8.4.6.1 - Authentication Bypass via OTP Bruteforcing Google Dork: inurl:/wp-content/plugins/digits/ Date: 2025-04-30 Exploit Author: Saleh Tarawneh Vendor Homepage: https://digits.unitedover.com/ Version: 8.4.6.1 CVE : CVE-2025-4094 """ The Digits plugin for...

CVE-2025-4094

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them...

CVE-2024-45404 OpenCTI's lack of Rate Limit lead to OTP brute forcing

OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attacker with valid credentials or a malicious user who commits internal fraud can break through the two-factor authentication and hijack the...