CVE-2025-14002

CVE-2025-14002 — The WPCOM Member plugin for WordPress allows authentication bypass via brute force. Root cause: weak OTP generation (6 digits) with a 10-minute validity and no rate limiting on verification attempts. Impact: unauthenticated attackers can log in as any user (including admins) if t...

CVE-2025-14002 WPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP

The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak OTP One-Time Password generation using only 6 numeric digits combined with a 10-minute validity window and no rate limiting on verificatio...

EUVD-2025-203621

The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak OTP One-Time Password generation using only 6 numeric digits combined with a 10-minute validity window and no rate limiting on verificatio...

CVE-2025-68113 ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to...

EUVD-2025-203484

ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to...

Improper Verification of Cryptographic Signature

Overview altcha is a The ALTCHA Python Library is a lightweight, zero-dependency library designed for creating and verifying ALTCHA challenges, specifically tailored for Python applications. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via t...

PT-2025-51469

Name of the Vulnerable Software and Affected Versions WPCOM Member plugin for WordPress versions prior to 1.7.17 Description The software is susceptible to authentication bypass through brute-force attacks. This is caused by a weak One-Time Password OTP generation process, utilizing only six...

WordPress plugin WPCOM Member 授权问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. An authorizatio...

CVE-2025-65427

An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to /api/login allowing attackers to brute force password enumerations...

PT-2025-51736

Name of the Vulnerable Software and Affected Versions Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router version V1.0.0 Description The Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router version V1.0.0 does not implement rate limiting on the /api/login endpoint. This allows attackers to attempt...

Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router 安全漏洞

Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router is a wireless router from Dbit China. A security vulnerability exists in the Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router version V1, which stems from unimplemented rate limiting and could lead to brute force password cracking...

ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to reinterpret a valid proof-of-work submission with a modified...

CIS-BA: Continuous Interaction Space Based Backdoor Attack for Object Detection in the Real-World

Object detection models deployed in real-world applications such as autonomous driving face serious threats from backdoor attacks. Despite their practical effectiveness,existing methods are inherently limited in both capability and robustness due to their dependence on single-trigger-single-objec...

CVE-2025-66482: Improper Restriction of Excessive Authentication Attempts

Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a reverse proxy at all can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option trustProxy has been added in config file to...

PT-2025-62893

Name of the Vulnerable Software and Affected Versions Better Auth versions prior to 1.4.5 Description Better Auth utilizes the better-call library, which depends on the rou3 router. In affected versions of rou3, paths are normalized by removing empty segments, causing paths such as /path, //path,...

PT-2025-51359

Name of the Vulnerable Software and Affected Versions ALTCHA versions prior to 1.0.0 Golang package ALTCHA versions prior to 1.0.0 Rubygem package ALTCHA versions prior to 1.0.0 pip package ALTCHA versions prior to 1.0.0 Erlang package ALTCHA versions prior to 1.4.1 altcha-lib npm package ALTCHA...

Misskey 安全漏洞

Misskey is a perpetually free open source syndicated social media platform from Misskey Open Source. A security vulnerability exists in Misskey versions prior to 2025.12.0-alpha.2, which stems from an insecure trustProxy configuration default value that could lead to bypassing IP rate limiting...

CVE-2025-65427

An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to /api/login allowing attackers to brute force password enumerations...

CVE-2025-65427

The Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router (firmware version V1.0.0 ) is vulnerable to a brute-force attack due to a lack of rate limiting on the /api/login endpoint (CWE-307). This flaw allows remote attackers to perform automated password enumeration via HTTP POST requests. A success...

CVE-2025-66482

Misskey CVE-2025-66482 affects the login rate-limiting mechanism via forged X-Forwarded-For headers. The vulnerability arises from an insecure default for trustProxy in the config, making instances vulnerable if not explicitly overridden. It is addressable starting with version 2025.9.1 by introd...