Joomla! 5.x < 5.2.6 Multiple Vulnerabilities

According to its self-reported version, the instance of Joomla! running on the remote web server is 4.x prior to 4.4.13 or 5.x prior to 5.2.6. It is, therefore, affected by multiple vulnerabilities. - Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr metho...

Joomla! 4.x < 4.4.13 Multiple Vulnerabilities

According to its self-reported version, the instance of Joomla! running on the remote web server is 4.x prior to 4.4.13 or 5.x prior to 5.2.6. It is, therefore, affected by multiple vulnerabilities. - Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr metho...

CVE-2025-25227

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

CVE-2025-25227

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

CVE-2025-25227

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

CVE-2025-25227 [20250402] - Joomla Core - MFA Authentication Bypass

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

PT-2025-15469 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla versions up to 4.4.12 and 5.2.5 Description: The issue is related to insufficient state checks, which create a vector allowing attackers to bypass 2FA checks. This leads to improper authentication. Recommendations: For Joomla versions ...

CVE-2025-32359

In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not wh...

CVE-2025-32359

In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not wh...

CVE-2025-32359

The CVE-2025-32359 entry concerns Zammad 6.4.x prior to 6.4.2, where a security check (re-authentication with the current password when changing two-factor authentication settings) is enforced only on the front end and not when calls are made via the API. Affected software: Zammad 6.4.0–6.4.1 (6....

CVE-2025-32359

In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not wh...

CVE-2025-32359

In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not wh...

BIT-JOOMLA-2021-23127 [20210301] - Core - Insecure randomness within 2FA secret generation

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes...

BIT-JOOMLA-2021-23126 [20210301] - Core - Insecure randomness within 2FA secret generation

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand function within the process of generating the 2FA secret...

CVE-2025-31694

Incorrect Authorization vulnerability in Drupal Two-factor Authentication TFA allows Forceful Browsing.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.10.0...

Brute Force

Overview alertwise is a Wagtail based weather warnings composing and dissemination tool Affected versions of this package are vulnerable to Brute Force due to insufficient login security measures affected version potentially vulnerable to brute-force and credential-stuffing attacks. The issue ste...

Drupal Two-factor Authentication (TFA) Vulnerable to Forceful Browsing

Incorrect Authorization vulnerability in Drupal Two-factor Authentication TFA allows Forceful Browsing. This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.10.0...

GHSA-HF6C-FGP3-JFCH Drupal Two-factor Authentication (TFA) Vulnerable to Forceful Browsing

Incorrect Authorization vulnerability in Drupal Two-factor Authentication TFA allows Forceful Browsing. This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.10.0...

CVE-2025-31694

Incorrect Authorization vulnerability in Drupal Two-factor Authentication TFA allows Forceful Browsing.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.10.0...

CVE-2025-31694 Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2025-023

Incorrect Authorization vulnerability in Drupal Two-factor Authentication TFA allows Forceful Browsing.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.10.0...