CVE-2026-7671

CVE-2026-7671 - Attaque par force brute OTP sur Tornet Scooter Résumé Restriction inadéquate des tentatives d'authentification excessives CWE-307 dans l'application mobile Tornet Scooter 4.75 sur Android. Détails Le point de terminaison /TwoFactor ne met pas en œuvre de limitation de débit ni de...

CVE-2025-56224

CVE-2025-56224 OTP 검증 우회 설명 공격자는 다른 사용자의 휴대폰 번호를 사칭하고 이 취약점을 이용하여 OTP 코드를 알지 못한 채 번호를 검증할 수 있습니다. CVSS 점수: 8.1 높음 공격 유형 원격 인증됨 영향을 받는 버전 8.6.8 이하 버전 제품 공급업체 Ascertia 영향을 받는 제품 코드 베이스 SigningHub 영향을 받는 구성 요소 휴대폰 번호 검증 기능. 완화 조치 시도 횟수가 특정 값을 초과하면 OTP 코드를 폐기합니다. 취약점 세부 정보 애플리케이션은 일회용 비밀번호OTP 검증 엔드포인...

CVE-2025-4094

CVE-2025-4094 – Плагин WordPress Digits 8.4.6.1 - Обход OTP-аутентификации Автор: Saleh Tarawneh CVE ID: CVE-2025-4094 Критичность: Критический CVSS 9.8 Статус: Исправлено в версии 8.4.6.1 Описание уязвимости Плагин Digits для WordPress версии ниже 8.4.6.1 уязвим к атакам перебора OTP из-за...

CVE-2025-10658

Exploit: Brute Force dell'OTP Guest di SupportCandy → Account Takeover 1 Avvia il flusso di login OTP browser Apri: root@kitploit: /support/ Seleziona login guest / OTP Inserisci l'email obiettivo es. [email protected] Invia 2 Estrai i valori richiesti dal modulo OTP Nella risposta di DevToo...

CVE-2025-4094-POC

Bypass OTP del Plugin WordPress Digits CVE-2025-4094 Panoramica Questo script è un exploit per il plugin WordPress Digits versioni -p -i OPTIONS Argomenti -u, --url: Obbligatorio URL del target es. https://example.com/wp-admin/admin-ajax.php -p, --phone: Obbligatorio Numero di telefono del target...

CVE-2026-57867

CVE-2026-57867 affects MicroRealEstate before or up to 1.0.0-alpha3, due to a lack of token state management that enables adversaries to bypass authentication and brute‑force One‑Time Passwords (OTP) to log in as any user. The root cause is insufficient token state handling, leading to an auth by...

CVE-2026-56450 AIL Framework - Missing Rate Limiting Enables Brute-Force Attacks Against Two-Factor Authentication Codes

AIL did not restrict repeated failed attempts to verify a two-factor authentication OTP code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an unlimited number of OTP guesses. This could enable...

CVE-2026-8760 Login with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force

The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for CVE-2024-11178: the rate-limit/lockout check added to otplloginaction was placed only inside the OTP-generation branch and is never...

CVE-2026-8760 Login with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force

The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for CVE-2024-11178: the rate-limit/lockout check added to otplloginaction was placed only inside the OTP-generation branch and is never...

CVE-2025-7630 OTP Password Brute Forcing in DorukNet's Wispotter

Improper Restriction of Excessive Authentication Attempts, Improper Authentication vulnerability in Doruk Communication and Automation Industry and Trade Inc. Wispotter allows Password Brute Forcing, Brute Force. This issue affects Wispotter: from 1.0 before v2025.10.08.1...

CVE-2025-14002

The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak OTP One-Time Password generation using only 6 numeric digits combined with a 10-minute validity window and no rate limiting on verificatio...

EUVD-2024-49847

Malicious code in bioql PyPI...

CVE-2025-10658

The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.3.7. This is due to missing rate limiting on the OTP verification for guest login. This makes it possible for unauthenticated attackers ...

WordPress Digits Plugin 8.4.6.1 - Authentication Bypass via OTP Bruteforcing

Exploit Title: WordPress Digits Plugin 8.4.6.1 - Authentication Bypass via OTP Bruteforcing Google Dork: inurl:/wp-content/plugins/digits/ Date: 2025-04-30 Exploit Author: Saleh Tarawneh Vendor Homepage: https://digits.unitedover.com/ Version: 8.4.6.1 CVE : CVE-2025-4094 """ The Digits plugin for...

CVE-2025-4094

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them...

CVE-2024-45404 OpenCTI's lack of Rate Limit lead to OTP brute forcing

OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attacker with valid credentials or a malicious user who commits internal fraud can break through the two-factor authentication and hijack the...