WSO2 is vulnerable to Open Redirect through multi-option URL in its authentication endpoint

An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site. By...

Mars: No Rate Limiting on Password Attempts After Insecure Registration Flow cause ATO

An authentication vulnerability was identified that lacked rate limiting controls on password attempts. The flaw allowed unlimited brute force attacks against user accounts without triggering security measures. Attackers could perform consecutive password attempts and distinguish successful...

PT-2025-23481 · Multilaser · Multilaser Sirius Re016 Mlt1.0

Name of the Vulnerable Software and Affected Versions: Multilaser Sirius RE016 MLT1.0 Description: A critical issue has been found in the Password Change Handler component, specifically in the /cgi-bin/cstecgi.cgi file. The manipulation of an unknown function leads to improper authentication,...

CVE-2025-33005

IBM Planning Analytics Local 2.0 and 2.1 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system...

PT-2025-23439 · Unknown · Mist Community Edition

Name of the Vulnerable Software and Affected Versions: Mist Community Edition versions up to 4.7.1 Description: A problematic issue has been found in the Authentication Endpoint component, specifically in the Login function of the file src/mist/api/views.py. The manipulation of the return to...

CVE-2025-4103

The WP-GeoMeta plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wpajaxwpgmstartgeojsonimport function in versions 0.3.4 to 0.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their...

CVE-2025-5286

The CVE-2025-5286 entry concerns the WordPress Bold Page Builder plugin. Affected: Bold Page Builder plugin for WordPress ≤ 5.3.6. Issue: Stored Cross-Site Scripting via the additional_settings parameter due to insufficient input sanitization and output escaping. Impact: Authenticated attackers w...

CVE-2025-48929

The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential e.g., not a token with a short expiration time that can be reused at a later date if discovered by an adversary...

CVE-2025-48929

The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential e.g., not a token with a short expiration time that can be reused at a later date if discovered by an adversary...

CVE-2025-48925

The TeleMessage service through 2025-05-05 relies on the client side e.g., the TM SGNL app to do MD5 hashing, and then accepts the hash as the authentication credential...

CVE-2025-48746

Netwrix Directory Manager formerly Imanami GroupID v.11.0.0.0 and before, as well as after v.11.1.25134.03 lacks Authentication for a Critical Function...

CVE-2024-54020

A missing authorization in Fortinet FortiManager versions 7.2.0 through 7.2.1, and versions 7.0.0 through 7.0.7 may allow an authenticated attacker to overwrite global threat feeds via crafted update requests...

CVE-2025-48929

The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential e.g., not a token with a short expiration time that can be reused at a later date if discovered by an adversary...

CVE-2025-48746

Netwrix Directory Manager formerly Imanami GroupID v.11.0.0.0 and before, as well as after v.11.1.25134.03 lacks Authentication for a Critical Function...

CVE-2025-48746

Netwrix Directory Manager formerly Imanami GroupID v.11.0.0.0 and before, as well as after v.11.1.25134.03 lacks Authentication for a Critical Function...

CVE-2025-41651 Weidmueller: Missing Authentication Vulnerability in Industrial Ethernet Switches

Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling unauthorized upload or download of configuration files and leading to full system compromise...

CVE-2025-40664

Missing authentication vulnerability in TCMAN GIM v11. This allows an unauthenticated attacker to access the resources /frmGestionUser.aspx/GetData, /frmGestionUser.aspx/updateUser and /frmGestionUser.aspx/DeleteUser...

CVE-2025-40653

User enumeration vulnerability in M3M Printer Server Web. This issue occurs during user authentication, where a difference in error messages could allow an attacker to determine whether a username is valid or not, allowing a brute force attack on valid usernames...

CVE-2025-40653 User enumeration in M3M Printer Server Web

User enumeration vulnerability in M3M Printer Server Web. This issue occurs during user authentication, where a difference in error messages could allow an attacker to determine whether a username is valid or not, allowing a brute force attack on valid usernames...

CVE-2025-40653

CVE-2025-40653 : Affects M3M Printer Server Web. In authentication, a difference in error messages can reveal whether a username is valid, enabling an attacker to perform username enumeration and brute-force attempts. Documents do not specify affected versions, root cause details beyond the valid...