9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

Summary 9router enforces a progressive login lockout 5 failed attempts → temporary 30s+ lock keyed on the client IP. The client IP used for this limiter is taken from the X-9r-Real-Ip request header, which is intended to be set only by the bundled custom-server.js layer from the unspoofable TCP...

9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

9router enforces a progressive login lockout 5 failed attempts → temporary 30s+ lock keyed on the client IP. The client IP used for this limiter is taken from the X-9r-Real-Ip request header, which is intended to be set only by the bundled custom-server.js layer from the unspoofable TCP socket...

CVE-2026-12379

An Open Redirect vulnerability CWE-601 exists in the OAuth/OIDC authentication implementation of the Axivion Dashboard. The login flow did not properly restrict the post-authentication redirect to the application's own origin, so a user who follows a crafted login link can be sent to an untrusted...

CVE-2026-55501: Improper Restriction of Excessive Authentication Attempts

9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the attacker-controlled X-Forwarded-For HTTP header, and src/app/api/auth/login/route.js uses that spoofable value for checkLock and recordFail...

CVE-2025-9770 Campcodes Hospital Management System Admin Dashboard Login admin sql injection

A weakness has been identified in Campcodes Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ of the component Admin Dashboard Login. This manipulation of the argument Password causes sql injection. It is possible to initiate the attack...

CampCodes Hospital Management System 安全漏洞

CampCodes Hospital Management System is a hospital management system from CampCodes, Inc. A security vulnerability exists in CampCodes Hospital Management System version 1.0, which originates from a SQL injection due to incorrect manipulation of the parameter Password in the component Admin...

CVE-2025-9770: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in Campcodes Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ of the component Admin Dashboard Login. This manipulation of the argument Password causes sql injection. It is possible to initiate the attack...

IBOS 安全漏洞

IBOS is a collaborative office management system open-sourced by IBOS China. A security vulnerability exists in IBOS version 4.5.5, which stems from the existence of an arbitrary file deletion vulnerability that can be deleted via systemmodulesdashboardcontrollersLoginController.php...

CVE-2024-8959: Improper Neutralization of Input During Web Page Generation

The WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.1.6 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2021-24944: Improper Neutralization of Input During Web Page Generation

The Custom Dashboard & Login Page WordPress plugin before 7.0 does not sanitise some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-9520

Name of the Vulnerable Software and Affected Versions Custom Dashboard & Login Page WordPress plugin versions prior to 7.0 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the plugin not sanitizing some of its settings, even when the unfiltered html...