GHSA-VQ9X-W82R-RHMC Soosyze CMS's /user/login endpoint missing rate-limiting and lockout mechanisms

Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to...

Brute Force

Overview soosyze/soosyze is a Soosyze CMS is a minimalist content management system in PHP, without database to create and manage your website easily. Affected versions of this package are vulnerable to Brute Force via the user/login endpoint due to the absence of rate-limiting and lockout...

CVE-2025-52392

Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to...

CVE-2025-52392

Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to...

CVE-2025-52392

CVE-2025-52392 affects Soosyze CMS 2.0. The root cause is missing rate-limiting and account lockout on the /user/login endpoint, enabling brute-force login attempts and potentially unauthorized administrative access. Public sources in connected documents describe a brute-force tool and PoC usage,...

CVE-2025-52392

Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to...

CVE-2025-52392

Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to...

soosyze 安全漏洞

soosyze is Soosyze open source a content management system . soosyze has a brute force vulnerability , the vulnerability stems from the /user/login endpoint lack of rate limiting and locking mechanism , an attacker can use this vulnerability to cause brute force attack...

CVE-2025-8773

CVE-2025-8773 concerns Dinstar Monitoring Platform (甘肃省危险品库监控平台) 1.0. The vulnerability is a SQL injection in an unknown function of the file /itc/${appPath}/login_getPasswordErrorNum.action triggered by manipulating userBean.loginName. Impact is described as remote exploit enabling full impact o...

CVE-2025-8773 Dinstar Monitoring Platform 甘肃省危险品库监控平台 login_getPasswordErrorNum.action sql injection

A vulnerability, which was classified as critical, was found in Dinstar Monitoring Platform 甘肃省危险品库监控平台 1.0. Affected is an unknown function of the file /itc/$%7BappPath%7D/logingetPasswordErrorNum.action. The manipulation of the argument userBean.loginName leads to sql injection. It is possible ...

CVE-2025-8156

A vulnerability was found in PHPGurukul User Registration & Login and User Management 3.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/lastsevendays-reg-users.php. The manipulation of the argument ID leads to sql injection. The attack may be...

WWBN AVideo 跨站脚本漏洞

WWBN AVideo is a video platform builder written in PHP by the WWBN team. A cross-site scripting vulnerability exists in WWBN AVideo version 14.4, which stems from the userLogin cancelUri parameter could lead to a cross-site scripting attack...

📄 Malicious Windows Registration Entries (.reg) File

This Metasploit module creates a Windows Registration Entries .reg file which adds the specified payload to the Windows Registry. The payload runs upon Windows login for the current user. If the user has elevated privileges when opening the file, the payload will run upon login when any user logs...

Online Banquet Booking System login.php file cross-site scripting vulnerability

Online Banquet Booking System is an online banquet booking system. A cross-site scripting vulnerability exists in Online Banquet Booking System, which originates from the userlogin/userpassword parameters not being effectively filtered in the /admin/login.php file. The vulnerability can be...

CVE-2025-7925

A vulnerability, which was classified as problematic, has been found in PHPGurukul Online Banquet Booking System 1.0. Affected by this issue is some unknown functionality of the file /admin/login.php. The manipulation of the argument userlogin/userpassword leads to cross site scripting. The attac...

CVE-2025-7608

A vulnerability, which was classified as critical, was found in code-projects Simple Shopping Cart 1.0. Affected is an unknown function of the file /userlogin.php. The manipulation of the argument useremail leads to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2025-7604

A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /user-login.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely...

PHPGurukul Hospital Management System 安全漏洞

Hospital Management System is a PHP and MySQL based hospital management system. Hospital Management System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally-entered SQL statement in the parameter Username in the file /user-login.php. An attack...

Code-Projects Simple Shopping Cart 注入漏洞

Code-Projects Simple Shopping Cart is Code-Projects open source a simple shopping cart system . An injection vulnerability exists in Code-Projects Simple Shopping Cart version 1.0, which originates from a SQL injection due to the incorrect operation of the parameter useremail in the file...

PHPGurukul User Registration & Login and User Management System 注入漏洞

PHPGurukul User Registration & Login and User Management System is a user registration & login and user management system from PHPGurukul Inc. An injection vulnerability exists in PHPGurukul User Registration & Login and User Management System version 3.3, which is caused by a SQL injection due t...