Contao: The registration module re-sends activation mails

ModuleRegistration::compile reaches its follow-up registration branch on any POST to a page carrying the module. That branch checks neither FORMSUBMIT nor the captcha result computed immediately above it, and resendActivationMail leads to OptInToken::send, which has no rate limit at all. Impact...

Default Password (oracle) for 'oracle' Account

The password for the account 'oracle' on the remote host is 'oracle'. An attacker may leverage this to gain access to the affected system and launch further attacks against it. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "oracle"; password = "oracle";...