33 matches found
CVE-2025-5955
The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0. This is due to the plugin not verifying a user's phone number before logging them in. This makes it possible for unauthenticated attackers to login as arbitrary...
CVE-2022-28601
A Two-Factor Authentication 2FA bypass vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor allows remote attackers to overwrite the phone number used for confirmation via the profile.php file. Therefore, allowing them to bypass the phone verification mechanism...
TikTok: Authentication Bypass on TikTok Seller Signup Process Allows Account Creation Without Phone Verification
The authentication bypass vulnerability on the TikTok Seller signup process allowed account creation without phone verification...
CVE-2022-28601
A Two-Factor Authentication 2FA bypass vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor allows remote attackers to overwrite the phone number used for confirmation via the profile.php file. Therefore, allowing them to bypass the phone verification mechanism...
CVE-2022-28601
A Two-Factor Authentication 2FA bypass vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor allows remote attackers to overwrite the phone number used for confirmation via the profile.php file. Therefore, allowing them to bypass the phone verification mechanism...
Authentication flaw
A Two-Factor Authentication 2FA bypass vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor allows remote attackers to overwrite the phone number used for confirmation via the profile.php file. Therefore, allowing them to bypass the phone verification mechanism...
CVE-2022-28601
CVE-2022-28601 concerns the Simple 2FA Plugin for Moodle by LMS Doctor. A 2FA bypass exists: remote attackers can overwrite the phone number used for confirmation via profile.php, thus bypassing the phone verification mechanism. The affected component is the Moodle plugin’s 2FA handling; the root...
Alohi: Misconfigured rate limit for SMS phone verification endpoint
One of our rate-limit configurations had a high threshold, allowing attackers to spam request multiple SMS codes by replicating the network request to a phone number before getting blocked...
Mail.ru: Bypass OTP on contact back request at https://driver.city-mobil.ru/
It was possible to bypass phone verification for support call back request...
Unikrn: Improper validation at Phone verification (possible cost increase + SMS SPAM attack)
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Please add the affected...
CAPTCHA Bypass Vulnerability in FAW-Volkswagen After-Sales Service App Android Version
FAW-VW After-sales Service APP is a software that provides professional after-sales service. Through this software, you can call roadside assistance with one click at anytime and anywhere. The software also provides personal automobile information, online reservation and automobile repair progres...
Mail.ru: No CSRF token used in Phone Verification POST
When I tried to register in mail.ru,I submitted my phone number and Got a verification code in my phone. During submission of that code,I saw that POST goes without any CSRF tokens.And I identified two other vulnerabilities on that procedure. 1. No Session Verification on server side while...
