Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite

Hoppscotch self-hosted backend = 2026.4.1 contains a broken authentication caused by mass assignment via unauthenticated POST /v1/onboarding/config endpoint, letting unauthenticated attackers overwrite JWTSECRET to forge tokens and fully compromise the server, exploit requires attacker to access...

ZimaOS - Authentication Bypass

ZimaOS = 1.5.0 contains a broken authentication caused by improper password validation for known system service accounts in the login function, letting attackers authenticate with any password for these accounts, exploit requires knowledge of common usernames. id: CVE-2026-21891 info: name: ZimaO...

CVE-2025-68860

CVE-2025-68860 WordPress Mobile builder Plugin Authentication Bypass Using an Alternate Path or Channel vulnerability in Mobile Builder allows Authentication Abuse. This issue affects Mobile builder from n/a through 1.4.2. CVSS Score: 9.8 CRITICAL Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H A...

lazyweb

LazyWeb - Vulnerable Web Application LazyWeb is a demonstration web application designed to showcase common server-side application vulnerabilities. Each vulnerability is categorized with its respective difficulty rating to provide a comprehensive learning experience for developers and security...

CVE-2025-68860

WordPress Mobile Builder = 1.4.2 - टूटा हुआ प्रमाणीकरण CVE-2025-68860 विवरण WordPress Mobile Builder प्लगइन संस्करण 1.4.2 और उससे नीचे में टूटे हुए प्रमाणीकरण की कमजोरी है, जो हमलावर को डिफ़ॉल्ट रहस्य "examplekey" के साथ एक मान्य JWT टोकन बनाने और व्यवस्थापक userid=1 के रूप में प्रमाणित करने की...

Flowise-CVE-2025-58434-PasswordReset

CVE-2025-58434 — Flowise AI अनधिकृत पासवर्ड रीसेट अवलोकन CVE ID: CVE-2025-58434 प्रभावित सॉफ़्टवेयर: Flowise AI कमज़ोर संस्करण: = 3.0.5 स्थिर संस्करण: 3.0.6 और बाद के गंभीरता: क्रिटिकल लेखक: r3nsi15 दिनांक: 2025 विवरण Flowise AI के संस्करण 3.0.5 तक सहित पासवर्ड रीसेट प्रवाह में एक टूटा हुआ...

Astra

Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...

CVE-2024-52475

CVE-2024-52475 إضافة Wawp لـ WordPress = 3.0.17 معرضة لثغرة كسر المصادقة الاستيلاء على الحساب إخلاء المسؤولية! المعلومات الواردة في هذا المستند بخصوص CVE-2024-52475 مخصصة لأغراض التعلم والتعليم فقط. نحن لا نشجع أو نصرح باستخدام هذه المعلومات لأي أغراض ضارة، بما في ذلك على سبيل المثال لا الحصر،...

CVE-2022-1598

CVE-2022-1598 WPQA where ID is numeric and can be bruteforced! Nuclei Template: CVE-2022-1598.yaml VIDEO POC:...

CVE-2026-84777

Unauthenticated Broken Authentication in Really Simple SSL = 9.8.0 versions...

CVE-2026-84777 WordPress Really Simple SSL plugin <= 9.8.0 - 2FA Bypass vulnerability

Unauthenticated Broken Authentication in Really Simple SSL = 9.8.0 versions...

EUVD-2026-70573

Unauthenticated Broken Authentication in Really Simple SSL = 9.8.0 versions...

CVE-2026-84777

WordPress Really Simple SSL plugin versions ≤ 9.8.0 are affected by an unauthenticated broken authentication vulnerability described as a 2FA bypass . The flaw allows a network-based attacker (with no prior privileges or user interaction, but high attack complexity) to compromise authentication, ...

CVE-2025-49901

CVE-2025-49901 WordPress Simple Link Directory Plugin 14.8.1 is vulnerable to a high priority Broken Authentication root@kitploit: ╔═══════════════════════════════════════════════════════════════════╗ ║ CVE-2025-49901 · Simple Link Directory · qc-opd ║ ║ Authentication Bypass → Password Reset → R...

CVE-2025-47646

🔐 CVE-2025-47646 – PSW Front-end Login & Registration = 1.12 📌 Plugin Information Plugin : PSW Front-end Login & Registration Vulnerable Version : = 1.12 CVE : CVE-2025-47646 Severity : High CVSS 9.8 Vulnerability Type : Broken Authentication Privilege Required : Unauthenticated Patched : ❌ No...

EUVD-2026-69861

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts...

EUVD-2026-69790

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access...

CVE-2026-82225

Unauthenticated Broken Authentication in RegistrationMagic = 6.0.9.8 versions...

EUVD-2026-68795

Unauthenticated Broken Authentication in RegistrationMagic = 6.0.9.8 versions...

CVE-2026-82225

RegistrationMagic (Custom Registration Form Builder with Submission Manager) WordPress plugin versions ≤ 6.0.9.8 are affected by an unauthenticated Broken Authentication vulnerability, discovered by Emiliano Carrizo. The CVSS v3.1 score is 7.4 (HIGH) with a network attack vector, high complexity,...