123 matches found
CVE-2026-92913
AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) uses a cryptographically weak PRNG in getRandomCode() (objects/functions.php), deriving account activation/login pairing codes from uniqid() with a single non-CSPRNG rand() character as padding, reducing the code space to ~2^25 valu...
CVE-2026-14182
The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...
Exploit for CVE-2026-12416
CVE-2026-12416-CVE-2026-12417 Unauthenticated Account Takeover...
CVE-2026-12416
The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the pravelinvoicechangepassword function being registered as a nopriv AJAX handler with no nonce verification and no authorization check, and...
PT-2026-51674
Name of the Vulnerable Software and Affected Versions Invoice Generator plugin for WordPress versions prior to 1.0.1 Description The Invoice Generator plugin for WordPress allows unauthenticated account takeover through a flaw in the password reset process. The pravel invoice change password...
Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES
Summary Password-reset tokens are generated using conf.Auth.ActivateCodeLives the account-activation lifetime, not conf.Auth.ResetPasswordCodeLives. The token lifetime is baked into the token itself at generation time and is re-extracted from the token at verification time, making...
Malicious Package
Overview @activationcode/success is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...
Malicious Package
Overview @activationcode/error is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-3108 Malicious code in @activation_code/success (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d00bacff8cfa3ae8a22cfb51c4be0ad025ce42bc29929c07a7eaad6be36c702c The package @activationcode/success was found to contain malicious code. Source: ghsa-malware...
Malicious code in @activation_code/success (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d00bacff8cfa3ae8a22cfb51c4be0ad025ce42bc29929c07a7eaad6be36c702c The package @activationcode/success was found to contain malicious code. Source: ghsa-malware...
MAL-2026-3106 Malicious code in @activation_code/activate (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 051c685a7704a23fd8a744185c9b8551c7acda63ebf95feabd3ca4b9e1f8ede6 The package @activationcode/activate was found to contain malicious code. Source: ghsa-malware...
Malicious code in @activation_code/activate (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 051c685a7704a23fd8a744185c9b8551c7acda63ebf95feabd3ca4b9e1f8ede6 The package @activationcode/activate was found to contain malicious code. Source: ghsa-malware...
Malicious code in @activation_code/error (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fec73b17468bf333bb1bf6a071209103b774e371dfbf9961ad522dbd006fff7d The package @activationcode/error was found to contain malicious code. Source: ghsa-malware...
EUVD-2019-20065
River Past Ringtone Converter 2.7.6.1601 contains a local buffer overflow vulnerability that allows attackers to crash the application by supplying oversized input to activation fields. Attackers can paste 300 bytes of data into the Email textbox and Activation code textarea via the Help menu's...
CVE-2019-25665
River Past Ringtone Converter 2.7.6.1601 contains a local buffer overflow vulnerability that allows attackers to crash the application by supplying oversized input to activation fields. Attackers can paste 300 bytes of data into the Email textbox and Activation code textarea via the Help menu's...
CVE-2019-25665
River Past Ringtone Converter 2.7.6.1601 contains a local buffer overflow vulnerability that allows attackers to crash the application by supplying oversized input to activation fields. Attackers can paste 300 bytes of data into the Email textbox and Activation code textarea via the Help menu's...
CVE-2019-25665 River Past Ringtone Converter 2.7.6.1601 Buffer Overflow DoS
River Past Ringtone Converter 2.7.6.1601 contains a local buffer overflow vulnerability that allows attackers to crash the application by supplying oversized input to activation fields. Attackers can paste 300 bytes of data into the Email textbox and Activation code textarea via the Help menu's...
PT-2026-30474
Name of the Vulnerable Software and Affected Versions River Past Ringtone Converter version 2.7.6.1601 Description A local buffer overflow occurs when the application receives oversized input in activation fields. An attacker can trigger a denial of service condition, causing the application to...
EUVD-2019-20037
River Past Audio Converter 7.7.16 contains a local buffer overflow vulnerability in the activation code field that allows local attackers to crash the application by supplying an oversized input string. Attackers can paste a large payload of repeated characters into the 'E-Mail and Activation Cod...
CVE-2019-25649
River Past Audio Converter 7.7.16 contains a local buffer overflow vulnerability in the activation code field that allows local attackers to crash the application by supplying an oversized input string. Attackers can paste a large payload of repeated characters into the 'E-Mail and Activation Cod...