CVE-2021-27651

CVE-2021-27651 Pega Infinity Password Reset Video Follow Youtube Twitter Telegram Vulnmachines.com...

CVE-2021-27651

摘要 攻击者可以绕过密码重置流程的所有步骤，重置Pega Infinity上任意用户的账户。具体方法是：1 启动密码重置流程并输入目标邮箱，然后2 强制通过HTTP POST请求更新密码。攻击者可以使用新编辑的账户登录，并通过多种可接受的认证后代码执行向量（修改动态页面、模板等）完全控制Pega实例。 复现步骤 1. 访问任意Pega实例的登录页面 2. 点击"重置密码" 3. 输入"[email protected]"，代理HTTP请求，将带有"[email protected]"的HTTP请求发送到Burp...

Pega Infinity - Authentication Bypass

Pega Infinity versions 8.2.1 through 8.5.2 contain an authentication bypass vulnerability because the password reset functionality for local accounts can be used to bypass local authentication checks. id: CVE-2021-27651 info: name: Pega Infinity - Authentication Bypass author: idealphase,daffainf...

CVE-2026-13761

Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping...

CVE-2026-13761

Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs used for loop conditions , which can cause excessive looping and potentially lead to denial of service or other consequences. The vulnerability is exploitable over the network with low complexity and no p...

CVE-2026-13761 Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping...

EUVD-2026-67718

Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping...

CVE-2026-10754

Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls...

CVE-2026-10754

Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls. The flaw impacts confidentiality and integrity (both HIGH) with network access and low attack complexity, no user interaction requ...

CVE-2026-10754

Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls...

CVE-2026-14337

Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...

CVE-2026-14337

CVE-2026-14337 affects Pega Platform versions 23.1.0 through 25.1.3, where a stored Cross-site Scripting (XSS) vulnerability exists in a user interface component. The flaw requires a high-privilege developer user and is described with a CVSS 4.0 base score of 4.6 (Medium). The provided data does ...

CVE-2026-14337 Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...

EUVD-2026-52686

Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...

CVE-2026-1562

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...

CVE-2026-1563

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...

CVE-2026-1563

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...

CVE-2026-1563 Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...

EUVD-2026-44727

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...

CVE-2026-1563

Pega Platform versions 8.1.0–25.1.2 are affected by a reflected XSS in a UI component. Exploitation requires a high-privilege user with a developer role; impact is limited to the affected UI context. CVSS 4.8 (MEDIUM) with low confidentiality/integrity impact and no availability impact. No exploi...