CVE-2020-15367

CVE-2020-15367 Supravizio BPM 10.1.2에서의 무차별 대입 공격 설명 Venki Supravizio BPM 10.1.2는 인증 시도 횟수를 제한하지 않습니다. 인증되지 않은 사용자는 이 취약점을 악용하여 로그인 페이지에 대해 무차별 대입 인증 공격을 수행할 수 있습니다. 악용 이 취약점을 악용하려면 비밀번호 복구의 사용자 열거 취약점CVE-2020-15392을 사용하여 유효한 사용자를 열거한 후, 다양한 비밀번호를 사용하여 임의의 횟수로 인증을 시도하고 최종적으로 대상 계정에 접근할 수 있습니다. Po...

CVE-2026-105237

A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminAuthController.java of the component Login Endpoint. The manipulation results in improper restriction of excessive...

EUVD-2026-92259

A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminAuthController.java of the component Login Endpoint. The manipulation results in improper restriction of excessive...

CVE-2026-8793

CVE-2026-8793 — PaperCut NG 로그인 폼의 무차별 대입Brute-Force 보호 부재 필드| 세부 사항 ---|--- CVE ID| CVE-2026-8793 제품| PaperCut NG 영향을 받는 버전| 25.0.11빌드 75758 및 이전 버전 CWE| CWE-307 — 과도한 인증 시도에 대한 부적절한 제한 CVSS 점수| 5.3 Medium — 단독 기준; CVE-2026-8794와 연쇄 사용 시 상승 연구자| Vivien LEBAS @Hazaz 신고일| 2026년 5월 상태| 패치 완료 —...

CVE-2026-103977

요약 FileRise 3.23.0 이전 버전은 실패한 TOTP 검증 시도를 PHP 세션 상태에 저장했습니다. 이 카운터는 하나의 세션 내에서 시도 횟수를 제한했지만, 새로 생성된 세션 간에는 유지되지 않았습니다. 대상 계정의 유효한 기본 자격 증명을 이미 보유한 공격자는 로그인 워크플로를 재시작하여 새로운 대기 중 로그인 세션을 받고 TOTP 시도 허용량을 복원할 수 있었습니다. 이 과정을 반복하면 의도된 5회 시도 제한을 넘어 지속적인 온라인 TOTP 추측이 가능했습니다. 세부 사항 TOTP 검증 흐름은 실패 카운터를...

CVE-2026-100501

Versions of Flame through 2.4.0 are vulnerable to an improper restriction of excessive authentication attempts in the POST /api/auth login endpoint. Due to a lack of rate limiting, attempt counters, lockouts, or delays, unauthenticated attackers can brute-force the administrator password. Success...

CVE-2026-37603: Improper Restriction of Excessive Authentication Attempts

Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder pH7 Social Dating CMS through 19.2.0. The CAPTCHA escalation flag is stored in the PHP session as captchaadminenabled and the CAPTCHA form element is only built when that flag is presen...

CVE-2026-37603

The pH7Builder (pH7 Social Dating CMS) software, versions through 19.2.0 , is vulnerable to an improper restriction of excessive authentication attempts in the administration login. The root cause is that the CAPTCHA escalation flag is stored in the PHP session as captcha_admin_enabled, and the C...

CVE-2026-37603

Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder pH7 Social Dating CMS through 19.2.0. The CAPTCHA escalation flag is stored in the PHP session as captchaadminenabled and the CAPTCHA form element is only built when that flag is presen...

CVE-2026-37603

Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder pH7 Social Dating CMS through 19.2.0. The CAPTCHA escalation flag is stored in the PHP session as captchaadminenabled and the CAPTCHA form element is only built when that flag is presen...

CVE-2026-46649: Improper Restriction of Excessive Authentication Attempts

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/loginwithcode/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An...

CVE-2026-77561: Improper Restriction of Excessive Authentication Attempts

Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/usercontroller.go...

CVE-2026-93650: Improper Restriction of Excessive Authentication Attempts

A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function getclientip of the file saleor/account/throttling.py. Executing a manipulation can lead to improper restriction of excessive authentication attempts. The attack can be executed...

CVE-2026-78490

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading ...

CVE-2026-78490

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading ...

EUVD-2026-74850

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading ...

CVE-2026-78490

Dell Secure Connect Gateway (SCG) 5.0 contains an Improper Restriction of Excessive Authentication Attempts vulnerability in both the Appliance (versions prior to 5.36.00.16) and Application (versions prior to 5.36.00.00) editions. An unauthenticated attacker with network access could exploit thi...

PT-2026-88940

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading ...

CVE-2026-78490: Improper Restriction of Excessive Authentication Attempts

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading ...

CVE-2026-6223: Improper Restriction of Excessive Authentication Attempts

Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass. This issue affects BiHayat App: from 2.1.7 through 07092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...