CVE-2025-28172

Grandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker can perform an arbitrary number of authentication attempts using different passwords and eventually gain access to the targeted account using a brute force...

CS Cart 安全漏洞

CS Cart is an e-commerce system from the US-based company CS Cart. A security vulnerability exists in CS Cart version 4.18.3, which stems from a lack of security controls and could lead to a brute force attack...

PT-2025-31554 · Cs Cart · Cs-Cart

Name of the Vulnerable Software and Affected Versions: CS Cart version 4.18.3 Description: The vendor login functionality lacks essential security controls, such as CAPTCHA verification and rate limiting. This allows an attacker to systematically attempt various combinations of usernames and...

CVE-2025-50850

An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limiting. This allows an attacker to systematically attempt various combinations of usernames and passwords brute-force attack to gain unauthoriz...

CVE-2025-50850

CS Cart 4.18.3 contains a login vulnerability where the vendor login endpoint lacks CAPTCHA verification and rate limiting, enabling brute-force attempts to gain unauthorized vendor access. The confirmed details indicate the issue stems from missing security controls on the login functionality, w...

CVE-2025-5922

Access to TSplus Remote Access Admin Tool is restricted to administrators unless "Disable UAC" option is enabled and requires a PIN code. In versions below v18.40.6.17 the PIN's hash is stored in a system registry accessible to regular users, making it possible to perform a brute-force attack usi...

CVE-2025-5922

TSplus Remote Access Admin Tool stores the PIN hash in the system registry for versions below 18.40.6.17, and the hash is not salted, enabling potential brute-force attacks using rainbow tables. Patches are provided in v18.40.6.17 and in LTS lines: v17.2025.6.27 and v16.2025.6.27. Affected compon...

CVE-2025-5922 Retrievable password hash protecting TSplus admin console

Access to TSplus Remote Access Admin Tool is restricted to administrators unless "Disable UAC" option is enabled and requires a PIN code. In versions below v18.40.6.17 the PIN's hash is stored in a system registry accessible to regular users, making it possible to perform a brute-force attack usi...

CVE-2025-28172

Grandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker can perform an arbitrary number of authentication attempts using different passwords and eventually gain access to the targeted account using a brute force...

CVE-2025-28172

Grandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker can perform an arbitrary number of authentication attempts using different passwords and eventually gain access to the targeted account using a brute force...

CVE-2025-28172

Grandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker can perform an arbitrary number of authentication attempts using different passwords and eventually gain access to the targeted account using a brute force...

PT-2025-31217 · Grandstream Networks · Ucm6510

Name of the Vulnerable Software and Affected Versions: Grandstream Networks UCM6510 versions 1.0.20.52 and earlier Description: The software is susceptible to improper restriction of excessive authentication attempts, allowing an attacker to perform a brute force attack to gain access to targeted...

PT-2025-31225 · Tsplus · Tsplus

Name of the Vulnerable Software and Affected Versions: TSplus versions prior to 18.40.6.17 TSplus versions prior to 17.2025.6.27 TSplus versions prior to 16.2025.6.27 Description: Access to the TSplus Remote Access Admin Tool is restricted to administrators unless the "Disable UAC" option is...

CVE-2025-54129

HAXiam is a packaging wrapper for HAXcms which allows anyone to spawn their own microsite management platform. In versions 11.0.4 and below, the application returns a 200 response when requesting the data of a valid user and a 404 response when requesting the data of an invalid user. This can be...

CVE-2025-6523

Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcing the short emergency codes generated by the server within a feasible timeframe. This issue affects the following versions : Devolutions...

CVE-2025-6523

Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcing the short emergency codes generated by the server within a feasible timeframe. This issue affects the following versions : Devolutions...

CVE-2025-6523

CVE-2025-6523 affects Devolutions Server, where the emergency authentication component allows unauthenticated bypass via brute-forcing short emergency codes. Affected are Devolutions Server 2025.2.2.0–2025.2.3.0 and 2025.1.11.0 and earlier. Root cause is use of weak credentials in the emergency a...

Brute Force Attack

org.glassfish.main.admingui, console-common is vulnerable to Login Brute Force attack. The vulnerability is due to the lack of limitation on the number of failed login attempts, which allows an attacker to repeatedly try different credentials to gain unauthorized access...

PT-2025-30444 · Devolutions · Devolutions Server

Name of the Vulnerable Software and Affected Versions: Devolutions Server versions 2025.1.11.0 through 2025.2.3.0 Description: The use of weak credentials in the emergency authentication component allows an unauthenticated attacker to bypass authentication by brute-forcing the short emergency cod...

CVE-2025-7393 Mail Login - Critical - Access bypass - SA-CONTRIB-2025-088

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0...