Monstra CMS HTTP Header Injection Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. An HTTP header injection vulnerability exists in the 'cfg' parameter of the...

There is an information leakage vulnerability in the APP of Beijing JIANNONG Online Information Technology Co.

KANO Online Layer Manager is a national informatization service platform for the egg industry and is a networked production management software platform for egg farms. The application has CAPTCHA information leakage: when registering and retrieving passwords, the server side returns the CAPTCHA t...

Shenzhen Jiya Technology Co., Ltd Jiya APP has information leakage vulnerability

JIYA APP is a cell phone housing search life application that includes new and second-hand housing functions. CAPTCHA Information Leakage: This vulnerability is mainly in the login and password retrieval, the server will return the verification code to the client, thus causing the leakage of...

CVE-2018-16979

Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943...

CVE-2018-16979

Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943...

Shanghai Pu Ding Culture Communication Co.

Tiger Tour is a self-guided tour service platform founded and operated by Shanghai Purding Culture Communication Co. Ltd. Tiger Tours APP has an SMS bombing vulnerability, the vulnerability stems from the failure of the server side to limit the number of times and time of CAPTCHA requests for the...

WordPress Ajax BootModal Login plugin <= 1.4.3 - CAPTCHA reuse vulnerability

CAPTCHA reuse required only once per user session vulnerability found by Lydéric Lefebvre and Fabien Haureils in WordPress Ajax BootModal Login plugin versions = 1.4.3. Solution 2018.09.01 - we were unable to find a patched version of this plugin...

PHPOKCMS has a logical design flaw

PHPOKCMS is an enterprise station CMS system developed in PHP+MYSQL language. A logical design vulnerability exists in PHPOKCMS. Attackers can log in to other accounts by grabbing packets and blasting CAPTCHA...

Bypass Protection Mechanism

phpMyFAQ/phpMyFAQ is vulnerable to bypassing protection mechanism. Due to the flaw in Captcha implementation, an attacker can bypass the Captcha protections on forms by replaying the request...

CVE-2014-6050

phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request...

Cross site request forgery (csrf)

phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request...

CVE-2014-6050

CVE-2014-6050 affects phpMyFAQ prior to 2.8.13 and allows remote attackers to bypass CAPTCHA protection by replaying the request. NVD describes CAPTCHA bypass; Veracode notes bypass of form protections via replay. Documented impact is bypass of CAPTCHA on forms; no remediation details are provide...

CVE-2014-6050

phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request...

CVE-2018-15876

An issue was discovered in the ajax-bootmodal-login plugin 1.4.3 for WordPress. The register form, login form, and password-recovery form require solving a CAPTCHA to perform actions. However, this is required only once per user session, and therefore one could send as many requests as one wished...

Design/Logic Flaw

An issue was discovered in the ajax-bootmodal-login plugin 1.4.3 for WordPress. The register form, login form, and password-recovery form require solving a CAPTCHA to perform actions. However, this is required only once per user session, and therefore one could send as many requests as one wished...

CVE-2018-15876

An issue was discovered in the ajax-bootmodal-login plugin 1.4.3 for WordPress. The register form, login form, and password-recovery form require solving a CAPTCHA to perform actions. However, this is required only once per user session, and therefore one could send as many requests as one wished...

CVE-2018-15876

An issue was discovered in the ajax-bootmodal-login plugin 1.4.3 for WordPress. The register form, login form, and password-recovery form require solving a CAPTCHA to perform actions. However, this is required only once per user session, and therefore one could send as many requests as one wished...

CVE-2018-15876

The CVE-2018-15876 issue affects the WordPress plugin ajax-bootmodal-login (version 1.4.3). The register, login, and password-recovery forms require solving a CAPTCHA, but the CAPTCHA is enforced only once per user session, enabling automated requests to be sent repeatedly and potentially brute-f...

Ajax BootModal Login <= 1.4.3 - Captcha Reuse

The Ajax BootModal Login WordPress plugin was affected by a Captcha Reuse security vulnerability...

Logic design flaws in Guangzhou reference app

Guangzhou Reference APP is a new media brand created by Guangzhou Daily Newspaper Group, which is an information platform. There is a logical design vulnerability in Guangzhou Reference APP. An attacker can reset any password and perform unauthorized operations by grabbing packets and blasting...