CVE-2025-56132

LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to determine the existence of user accounts. Version 4.2...

Joomla 4.0.x < 4.4.14 / 5.0.x < 5.3.4 Joomla 5.3.4 Security & Bugfix Release (5936-joomla-5-3-4-security-bugfix-release)

According to its self-reported version, the instance of Joomla! running on the remote web server is 4.0.x prior to 4.4.14 or 5.0.x prior to 5.3.4. It is, therefore, affected by a vulnerability. - Improper handling of authentication requests lead to a user enumeration vector in the passkey...

PT-2025-40004

Name of the Vulnerable Software and Affected Versions affected versions not specified Description Improper handling of authentication requests results in a user enumeration vector within the passkey authentication method. This allows an attacker to potentially identify valid users. Recommendation...

CVE-2025-56132

LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to determine the existence of user accounts. Version 4.2...

CVE-2025-56132: Authentication Bypass by Primary Weakness

LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to determine the existence of user accounts. Version 4.2...

CVE-2025-54477: Observable Discrepancy

Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method...

PT-2025-39869

Name of the Vulnerable Software and Affected Versions Trivision NC-227WF firmware version 5.80 build 20141010 Description The login mechanism in the software allows an attacker to determine if a username is valid by observing different error messages. Specifically, a “Unknown user” message...

CVE-2025-45994

An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active Directory via sending a crafted POST request to /user/existdirectory/1...

CVE-2025-45994

An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active Directory via sending a crafted POST request to /user/existdirectory/1...

CVE-2025-45994

An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active Directory via sending a crafted POST request to /user/existdirectory/1...

Aranda PassRecovery 安全漏洞

Aranda PassRecovery is a password recovery tool from the Colombian company Aranda. A security vulnerability exists in Aranda PassRecovery version 1.0, which stems from an unauthenticated specially crafted POST request that could lead to the enumeration of valid user accounts in Active Directory...

CVE-2025-45994

The password recovery tool Aranda PassRecovery v1.0 is vulnerable to an issue that allows unauthenticated attackers to enumerate valid user accounts in Active Directory. This is achieved by sending a crafted POST request to the /user/existdirectory/1 API endpoint. This vulnerability falls under C...

CVE-2025-45994

An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active Directory via sending a crafted POST request to /user/existdirectory/1...

CVE-2025-41716 Unauthenticated User Enumeration via Missing Authentication

The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing authentication for critical function...

CVE-2025-41716

CVE-2025-41716 describes an unauthenticated information disclosure where a remote attacker can enumerate existing user accounts and their roles due to missing authentication for a critical function. Connected sources reference WAGO Device Sphere and WAGO Solution Builder as affected, describing a...

CVE-2025-41716 Unauthenticated User Enumeration via Missing Authentication

The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing authentication for critical function...

PT-2025-39238

Name of the Vulnerable Software and Affected Versions Web Application affected versions not specified Description The web application has a flaw that allows an unauthenticated remote attacker to gather information about existing user accounts, including their roles, due to a lack of authenticatio...

CVE-2025-58434

Flowise was vulnerable in versions up to 3.0.5 where the forgot-password API returned a valid tempToken and other sensitive user data without authentication, enabling an unauthenticated attacker to reset passwords and take over accounts (including admins). A fix was released in version 3.0.6 that...

User Enumeration

com.liferay, com.liferay.login.web is vulnerable to User Enumeration. The vulnerability is due to improper handling of account creation requests on the "create account" page, which allows an attacker to determine if a specific account exists in the application...

Sensitive Information Disclosure

Liferay Portal is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper access control due to weak validation in the calendar feature, which allows authenticated users to enumerate other users’ calendars and use this information for phishing attacks...