MetInfo has a logic flaw

MetInfo is a Content Management System CMS developed using PHP and Mysql. A logic vulnerability exists in MetInfo 5.3.17 and earlier versions. A remote attacker can exploit this vulnerability by changing the data flow between client servers to bypass captcha...

Password Breaches Fueling Booming Credential Stuffing Business

The market for credential stuffing software and services is thriving thanks in large part to an epidemic of breaches of usernames and passwords. Digital Shadows said today in a new report that credential leaks, such as this past month’s Anti Public Combo List and others, have buoyed the market fo...

Allen Disk Security Bypass Vulnerability

Allen Disk is a free, open source cloud-based hard disk product that features encrypted file storage, online preview, file sharing and more. A security bypass vulnerability exists in the reg.php file in Allen Disk version 1.6. An attacker can exploit this vulnerability to bypass CAPTCHA with the...

CVE-2017-9090

reg.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code'==1, which makes it possible to bypass the CAPTCHA via an empty $POST'captcha'...

CVE-2017-9090

reg.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code'==1, which makes it possible to bypass the CAPTCHA via an empty $POST'captcha'...

CVE-2017-9091

/admin/loginc.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code' == 1, which leads to CAPTCHA bypass by emptying $POST'captcha'...

CVE-2017-9091

The CVE-2017-9091 entry concerns Allen Disk 1.6: /admin/loginc.php does not verify isset($_SESSION['captcha']['code']) before processing, enabling CAPTCHA bypass by clearing $_POST['captcha']. The Red Hat and NVD records confirm the same issue; no public exploit details or patches are described i...

CVE-2017-9091

/admin/loginc.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code' == 1, which leads to CAPTCHA bypass by emptying $POST'captcha'...

CVE-2017-9090

The CVE-2017-9090 issue affects Allen Disk 1.6’s reg.php, where there is no proper check of isset($_SESSION['captcha']['code']), enabling bypass of CAPTCHA via an empty $_POST['captcha']. The vulnerability is documented across multiple feeds (NVD entry with CVSSv2/3 scores indicating low–high imp...

Weblate: Captcha bypass at registration

Affected URL: https://demo.weblate.org/accounts/register/ Issue: The captchas are implement so that the site can differentiate between the legitimate user and the bot. The captcha challenge should be something that a bot cannot solve easily and a human could easily solve. However, in the above UR...

Weblate: Captcha Bypass at Email Reset can lead to Spamming users.

Because of 223525 you've implemented captcha on Reset Email functionality. But it can be bypassed and any attacker can flood/spam victim with reset emails in his Email Inbox...

Weblate: Bypassing captcha in registration on Hosted site

Hello again, I believe the captcha on the user registration form is very simple and can be easily bypassed to automatically register any number of accounts. A program can read the math captcha, solve it and submit the form with the answer and the other required parameters & headers. Note: I read...

Weblate: Registration captcha bypass

Hello, I've found that it is possible to bypass captcha during registration. Attacker can automatize registration process and create multiple accounts. Here are steps to reproduce: 1. Go to registration page. Type information and catch request in proxy. 2. Get correct answer for captcha and captc...

Automattic: Captcha bypass for the most important function - At en.instagram-brand.com

Product / URL https://en.instagram-brand.com/wp-json/brc/v1/approval-requests Description and Impact The Instagram Brand Site has a functionality for business users to request for using Instagram Assets. The URL for creating a new request is: https://en.instagram-brand.com/requests/new There is a...

CVE-2016-8600

In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later...

dotCMS CAPTCHA Bypass Vulnerability

Exploit for php platform in category web applications Title: CVE-2016-8600 dotCMS - CAPTCHA bypass by reusing valid code Credit: Elar Lang / https://security.elarlang.eu Vulnerability: CAPTCHA bypass by re-using last loaded valid CAPTCHA code Vulnerable version: before 3.6.0 CVE: CVE-2016-8600...

Magento Community Edition 2.x < 2.0.1 Multiple Vulnerabilities

Binary data 9692.prm...

Login CAPTCHA Bypass Vulnerability in AVTECH Device Login Parameter

AVTECH, founded in 1996, is one of the world's leading CCTV manufacturers. The main products are surveillance equipment, network cameras, network video recorders and so on. There is a login authentication code bypass vulnerability in the login parameter of AVTECH devices. When the login request...

██████: Cross-site request forgery vulnerability resulting in the deletion of a user's account.

One of the first cross-site request forgery vulnerabilities that I discovered on █████ allowed me to delete an unsuspecting user's account. In order to exploit this issue, I crafted a simple HTML form that sent a POST request to the /unregister endpoint when a user loaded the malicious page. html...

AWS CAPTCHA Bypass

The process of AWS login has a feature: if you use "fresh" browserno cookie, no cache, etc to sign in, put correct email and correct password there, CAPTCHA is required"To better protect your account, please re-enter your password and then enter the characters as they are shown in the image below...