CVE-2025-24023 Observable Response Discrepancy in flask-appbuilder

Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3...

CVE-2025-24023 Observable Response Discrepancy in flask-appbuilder

Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3...

CVE-2025-1869

SQL injection vulnerability have been found in 101news affecting version 1.0 through the "username" parameter in admin/checkavalability.php...

CVE-2025-1869

SQL injection vulnerability have been found in 101news affecting version 1.0 through the "username" parameter in admin/checkavalability.php...

CVE-2025-1869

CVE-2025-1869 describes a SQL injection vulnerability in the 101news project (version 1.0) affecting the username parameter in admin/check_avalability.php. Root cause: improper input handling in that parameter allows injection into the SQL query. Impact per CVSS is high across confidentiality, in...

CVE-2025-1869 SQL injection vulnerability in 101news

SQL injection vulnerability have been found in 101news affecting version 1.0 through the "username" parameter in admin/checkavalability.php...

Flask App Builder security vulnerabilities

Flask App Builder is a simple and fast application development framework by Daniel Vaz Gaspar Personal Developer. A security vulnerability exists in Flask App Builder versions prior to 4.5.3, which stems from an unauthenticated user being able to enumerate existing usernames...

CVE-2025-1869: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability have been found in 101news affecting version 1.0 through the "username" parameter in admin/checkavalability.php...

PT-2025-9318

Name of the Vulnerable Software and Affected Versions 101news versions 1.0 Description A SQL injection issue has been identified, specifically through the username parameter in the "admin/check avalability.php" endpoint. Recommendations For version 1.0, consider restricting access to the...

CVE-2025-24023: Observable Response Discrepancy

Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3...

CVE-2025-1842: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic was found in FITSTATS Technologies AthleteMonitoring up to 20250302. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument username leads to cross site scripting. The attack can be initiated remotely. The exploit...

PT-2025-9507

Name of the Vulnerable Software and Affected Versions Flask-AppBuilder versions prior to 4.5.3 Description The issue allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. Recommendations For versions prior to...

PT-2025-9236

Name of the Vulnerable Software and Affected Versions AthleteMonitoring up to 20250302 Description A problematic vulnerability was found in AthleteMonitoring, affecting the /login.php file. The issue is related to the manipulation of the username argument, which leads to cross-site scripting. Thi...

CVE-2025-27416 Asking For Scratch Username And Password

Scratch-Coding-Hut.github.io is the website for Coding Hut. The website as of 28 February 2025 contained a sign in with scratch username and password form. Any user who used the sign in page would be susceptible to any other user signing into their account. As of time of publication, a fix is not...

CVE-2025-27416 Asking For Scratch Username And Password

Scratch-Coding-Hut.github.io is the website for Coding Hut. The website as of 28 February 2025 contained a sign in with scratch username and password form. Any user who used the sign in page would be susceptible to any other user signing into their account. As of time of publication, a fix is not...

CVE-2025-27416 Asking For Scratch Username And Password

Scratch-Coding-Hut.github.io is the website for Coding Hut. The website as of 28 February 2025 contained a sign in with scratch username and password form. Any user who used the sign in page would be susceptible to any other user signing into their account. As of time of publication, a fix is not...

Navidrome allows an authentication bypass in Subsonic API with non-existent username

Summary In certain Subsonic API endpoints, authentication can be bypassed by using a non-existent username combined with an empty salted password hash. This allows read-only access to the server’s resources, though attempts at write operations fail with a “permission denied” error. Details A flaw...

GHSA-C3P4-VM8F-386P Navidrome allows an authentication bypass in Subsonic API with non-existent username

Summary In certain Subsonic API endpoints, authentication can be bypassed by using a non-existent username combined with an empty salted password hash. This allows read-only access to the server’s resources, though attempts at write operations fail with a “permission denied” error. Details A flaw...

TRENDnet TEW-821DAP Function Code Execution

The vulnerability of the admadduser function in the ssi service of TRENDnet TEW-821DAP wireless access points is related to the escape of the operation outside the buffer in memory when processing the username parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code o...

adm_mod_pwd() function in the Code Execution

The vulnerability of the admmodpwd function in the SSI microprogramming system of TRENDnet TEW-821DAP wireless access points is related to the escape operation from memory buffers when processing the username parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code or...