CVE-2025-54422 Sandboxie exposes encrypted sandbox key during password change

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a critical security vulnerability exists in password handling mechanisms. During encrypted sandbox creation, user passwords are transmitted via shared memory,...

Sandboxie 安全漏洞

Sandboxie is sandboxie-plus open source sandbox-based isolation software. A security vulnerability exists in Sandboxie 1.16.1 and earlier versions, which stems from the explicit transfer of credentials in the password handling mechanism and could lead to credential disclosure...

PT-2025-31199 · Sandboxie · Sandboxie

Name of the Vulnerable Software and Affected Versions: Sandboxie versions 1.16.1 and earlier Description: Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. A critical security issue exists in password handling mechanisms. During encrypted...

GO-2025-3792 File Browser vulnerable to insecure password handling in github.com/filebrowser/filebrowser

File Browser vulnerable to insecure password handling in github.com/filebrowser/filebrowser...

Insecure Password Handling

github.com/filebrowser/filebrowser is vulnerable to Insecure Password Handling. The vulnerability is due to a missing password policy and lack of brute-force protection, which allows an attacker to perform brute-force attacks to retrieve user account passwords...

CVE-2025-52997 File Browser Insecurely Handles Passwords

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a...

GHSA-CM2R-RG7R-P7GG File Browser vulnerable to insecure password handling

Summary All user accounts authenticate towards a File Browser instance with a password. A missing password policy and brute-force protection makes it impossible for administrators to properly secure the authentication process. Impact Attackers can mount a brute-force attack against the passwords ...

CVE-2025-26199

CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability. The application transmits passwords over unencrypted HTTP during the login process, exposing sensitive credentials to potential interception by network-based attackers. A remote attacker with access ...

TencentOS Server 3: fwupd (TSSA-2023:0301)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0301 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

TencentOS Server 4: fwupd (TSSA-2025:0084)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0084 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

The vulnerability of the setWiFiRepeaterCfg() function in the microprogrammed software of the TOTOLink T10 routers allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the setWiFiRepeaterCfg function in the TOTOLink T10 router’s microprogramming system arises due to buffer overflow when processing the password parameter. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the...

CVE-2021-39289

Certain NetModule devices have Insecure Password Handling cleartext or reversible encryption, These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.105 are affected: NB800, NB1600, NB1601, NB1800, NB1810, NB2700, NB2710, NB2800, NB2810, NB3700, NB3701, NB3710, NB3711, NB3720, and NB38...

Code-Projects Tourism Management System 安全漏洞

Code-Projects Tourism Management System is an open source tourism management system from Code-Projects. A security vulnerability exists in Code-Projects Tourism Management System version 1.0, which is caused by a stack buffer overflow due to incorrect manipulation of the username/password...

The vulnerability of TP-Link M7450 router’s microprogramming software lies in the lack of protective measures for the SQL query structure, allowing attackers to execute arbitrary code.

The vulnerability of TP-Link M7450 router’s microprogramming software is related to the lack of measures taken to protect the SQL query structure during the processing of the username and password fields. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary cod...

TinyWebServer 安全漏洞

TinyWebServer is a C++ lightweight WebServer server for Linux by qinguoyi personal developer. A security vulnerability exists in TinyWebServer 1.0 and earlier versions, which stems from an incorrect manipulation of the name/password parameter that can lead to SQL injection...

Tenda W18E 安全漏洞

The Tenda W18E is a wireless router from the Chinese company Tenda. The Tenda W18E suffers from a stack buffer overflow vulnerability that originates from a stack buffer overflow in the formSetAccountList function's handling of the parameter Password. An attacker could exploit this vulnerability ...

The vulnerability of the Meetup plugin in the WordPress content management system lies in the complexity of authentication processes involving user-controlled passwords. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the Meetup plugin in the WordPress content management system is related to the login process, which involves the use of a password controlled by the user. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

PT-2025-7701 · Excitel Broadband Private · My Excitel App

Name of the Vulnerable Software and Affected Versions: Excitel Broadband Private my Excitel App version 3.13.0 Description: A vulnerability was found in the One-Time Password Handler component, leading to improper restriction of excessive authentication attempts. The vendor was contacted about th...

The vulnerability in the `prog.cgi` script of the SetQuickVPNSettings module of the D-Link DIR-853 A1 router’s software allows a hacker to cause a service failure.

The vulnerability in the prog.cgi script of the SetQuickVPNSettings module of the D-Link DIR-853 A1 router operating system is related to buffer overflow during the processing of the Password parameter. Exploiting this vulnerability can allow an attacker to cause a service failure remotely...

CVE-2020-8862

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from t...