2360 matches found
CVE-2025-48187
CVE-2025-48187 affects RAGFlow up to version 0.18.1. The root cause is brute-force attacks on six-digit email verification codes without rate limiting, enabling account takeover via arbitrary registration, login, or password reset. Multiple connected sources confirm the issue and its impact. Prac...
CVE-2025-48187
RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rate limiting...
CVE-2025-47791 Nextcloud Server's test remote endpoint is not rate limited
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently unused endpoint to verify a share recipient was not protected correctly, allowing to proxy requests...
CVE-2025-47791
The vulnerability CVE-2025-47791 affects Nextcloud Server (self-hosted) and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3. The issue is an improperly protected, currently unused endpoint used to verify a share recipient, which could proxy requests to another server. Affected v...
CVE-2025-46739
An unauthenticated user could discover account credentials via a brute-force attack without rate limiting...
PT-2025-21179 · Rallly · Rallly
Name of the Vulnerable Software and Affected Versions: Rallly versions up to and including 3.22.1 Description: The issue concerns the token-based authentication mechanism in Rallly, an open-source scheduling and collaboration tool. When a user attempts to log in, a 6-digit code is sent to their...
PT-2025-20873 · Siemens · Scalance Lpe9403
Name of the Vulnerable Software and Affected Versions: SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions Description: A flaw has been identified in the handling of multiple incoming Profinet packets received in rapid succession. An unauthenticated remote attacker can exploit this issue by sending...
CVE-2025-46739
An unauthenticated user could discover account credentials via a brute-force attack without rate limiting...
CVE-2025-46739 Improper Restriction of Excessive Authentication Attempts
An unauthenticated user could discover account credentials via a brute-force attack without rate limiting...
CVE-2025-46739
CVE-2025-46739 describes unauthenticated brute-force against accounts with no rate limiting, potentially exposing credentials. Connected sources indicate affected Schweitzer Engineering Laboratories products (e.g., SEL-5033 acSELerator RTAC software and related SEL devices; Blueframe OS) but do n...
CVE-2025-46739 Improper Restriction of Excessive Authentication Attempts
An unauthenticated user could discover account credentials via a brute-force attack without rate limiting...
BIT-MASTODON-2023-49952
Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header...
BIT-MASTODON-2024-34535
In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header...
pixiv: Bypassing Inbox Privacy Settings and Enabling Spam on Pixiv.net
A vulnerability was discovered in the messaging system of Pixiv.net. The vulnerability allowed any user to bypass the inbox privacy settings and send messages to another user who had disabled their inbox. The vulnerability was triggered by manipulating the id parameter in the message-sending POST...
Lichess: Weak Rate Limiting Controls in the (LOGIN) page Expose System to Brute Force and DoS Attacks
Summary: The login page lacks proper rate limiting, allowing an attacker to easily perform a brute-force attack. This vulnerability enables the attacker to systematically try different username and password combinations until they successfully compromise any account, which poses a significant...
BIT-JOOMLA-2023-23755 [20230502] - Core - Bruteforce prevention within the mfa screen
An issue was discovered in Joomla! 4.2.0 through 4.3.1. The lack of rate limiting allowed brute force attacks against MFA methods...
Brute Force
Overview alertwise is a Wagtail based weather warnings composing and dissemination tool Affected versions of this package are vulnerable to Brute Force due to insufficient login security measures affected version potentially vulnerable to brute-force and credential-stuffing attacks. The issue ste...
CVE-2025-25595
A lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack...