PT-2025-5899 · Nextend · Nextend Social Login Pro

Name of the Vulnerable Software and Affected Versions: Nextend Social Login Pro versions up to, and including, 3.1.16 Description: The issue is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugin. This makes it possible for...

CVE-2024-30264

Typebot is an open-source chatbot builder. A reflected cross-site scripting XSS in the sign-in page of typebot.io prior to version 2.24.0 may allow an attacker to hijack a user's account. The sign-in page takes the redirectPath parameter from the URL. If a user clicks on a link where the...

MAL-2025-1068 Malicious code in browser-sign-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6d411988c71278a3b1cc021357c555ec43f75d6834289977b60fb08c1ce8d19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in custom-sign-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59f7b65e1e7c3a5681f3302cca12603566d8b1d18e7b9a4803632415f935f0aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in browser-sign-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6d411988c71278a3b1cc021357c555ec43f75d6834289977b60fb08c1ce8d19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1105 Malicious code in custom-sign-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59f7b65e1e7c3a5681f3302cca12603566d8b1d18e7b9a4803632415f935f0aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

January 28, 2025—KB5050094 (OS Build 26100.3037) Preview

None None...

CVE-2025-0693

Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an arbitrary AWS account...

CVE-2025-0693

AWS IAM (Identity and Access Management) is affected. The issue arises in the sign-in flow where variable response times could be exploited to enumerate valid usernames in an AWS account. Impact is described as enabling brute-force username discovery; no explicit exploit vectors or mitigations ar...

CVE-2025-0693 Issue with AWS Sign-in IAM User Login Flow - Possible Username Enumeration

Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an arbitrary AWS account...

CVE-2025-0693 Issue with AWS Sign-in IAM User Login Flow - Possible Username Enumeration

Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an arbitrary AWS account...

CVE-2024-11015

The Sign In With Google plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.8.0. This is due to the 'authenticateuser' user function not implementing sufficient null value checks when setting the access token and user information. This makes it...

WordPress plugin Sign In With Google 授权问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A vulnerability exists in the WordPress...

CVE-2024-11015: Improper Authentication

The Sign In With Google plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.8.0. This is due to the 'authenticateuser' user function not implementing sufficient null value checks when setting the access token and user information. This makes it...

VulnCheck KEV: CVE-2024-11015

The Sign In With Google plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.8.0. This is due to the 'authenticateuser' user function not implementing sufficient null value checks when setting the access token and user information. This makes it...

CVE-2024-10156

A vulnerability was found in PHPGurukul Boat Booking System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/index.php of the component Sign In Page. The manipulation of the argument username leads to sql injection. The attack can be initiated...

CVE-2024-10156 PHPGurukul Boat Booking System Sign In Page index.php sql injection

A vulnerability was found in PHPGurukul Boat Booking System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/index.php of the component Sign In Page. The manipulation of the argument username leads to sql injection. The attack can be initiated...

CVE-2024-10156 PHPGurukul Boat Booking System Sign In Page index.php sql injection

A vulnerability was found in PHPGurukul Boat Booking System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/index.php of the component Sign In Page. The manipulation of the argument username leads to sql injection. The attack can be initiated...

PT-2024-16069 · Unknown · Phpgurukul Boat Booking System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Boat Booking System version 1.0 Description: A critical issue has been found in the Sign In Page component of the PHPGurukul Boat Booking System, specifically in the /admin/index.php file. The manipulation of the username argument...

PHPGurukul Boat Booking System SQL注入漏洞

PHPGurukul Boat Booking System is a boat booking system from PHPGurukul. A SQL injection vulnerability exists in PHPGurukul Boat Booking System version 1.0, which originates from a SQL injection vulnerability in the username parameter of the /admin/index.php page of the Sign In Page component...