108 matches found
CVE-2025-63700
CVE-2025-63700 Clerk-js 5.88.0 における OAuth 認証バイパス 影響を受ける製品 ベンダー : Clerk Inc. clerk.dev / clerk.com 製品 : Clerk-js @clerk/clerk-js 影響を受けるバージョン : 5.88.0 影響 : OAuth 認証バイパス CWE-290 : スプーフィングによる認証バイパス 脆弱性発見者 Hasnat Ibrahim Nishat - LinkedIn Md Foysal Hossain - LinkedIn Md Asadujjaman Noor - LinkedIn 説明...
CVE-2026-85237 Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass
A vulnerability in MISP's email-based one-time password OTP authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The emailotp endpoint did not apply brute-force protection when validating submitted OTP values. An attacker who had reached the OTP...
CVE-2026-85237
MISP 's email_otp() endpoint lacked brute-force protection when validating OTP values, allowing an attacker who had passed the primary credential check to submit unlimited OTP guesses while the same OTP remained valid. The risk was compounded because OTPs are bound to the user rather than a singl...
CVE-2026-85237 Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass
A vulnerability in MISP's email-based one-time password OTP authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The emailotp endpoint did not apply brute-force protection when validating submitted OTP values. An attacker who had reached the OTP...
PT-2026-85081
A vulnerability in MISP's email-based one-time password OTP authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The email otp endpoint did not apply brute-force protection when validating submitted OTP values. An attacker who had reached the OTP...
CVE-2026-61967
Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...
CVE-2026-61967
Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...
EUVD-2026-57972
Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...
CVE-2026-61967
CVE-2026-61967 concerns an unauthenticated privilege-escalation vulnerability in the WordPress plugin miniorange OTP Verification (versions
CVE-2026-61967: Weak Password Recovery Mechanism for Forgotten Password
Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...
WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by VDsec in WordPress Plugin miniorange otp verification versions = 5.5.1...
CVE-2026-15210
The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...
CVE-2026-15210: Improper Authentication
The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...
EUVD-2026-51933
The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...
CVE-2026-14309
The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their...
PT-2026-67041
The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their...
PT-2026-65403
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the billing phone parameter. This is due to the processRegistration...
CVE-2026-61957 WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in miniorange otp verification = 5.5.1 versions...
WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Tarcísio LuchesiPoystick in WordPress Plugin miniorange otp verification versions = 5.5.1...