CVE-2026-118984

OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock o...

CVE-2026-118984

OmniRoute versions 3.8.0 before 3.8.52 are vulnerable to an unverified password change vulnerability. The flaw allows holders of manage-scoped or admin-scoped API keys, or oma_ access tokens, to change the management password without providing the current password. An attacker can exploit this by...

EUVD-2026-112722

OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock o...

CVE-2026-118984

OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock o...

PT-2026-132071

OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock o...

Cheaper Inference OmniRoute authorization issue vulnerability

In Cheaper Inference OmniRoute versions 3.8.0 through 3.8.52, there is an authorization issue vulnerability. This stems from the lack of validation for current passwords. Attackers possessing administrative or administrator-level API keys or oma access tokens can modify the admin password by...

CVE-2026-118984: cheaper-inference OmniRoute: OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or…

OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock o...

9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

Summary 9router enforces a progressive login lockout 5 failed attempts → temporary 30s+ lock keyed on the client IP. The client IP used for this limiter is taken from the X-9r-Real-Ip request header, which is intended to be set only by the bundled custom-server.js layer from the unspoofable TCP...

9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

9router enforces a progressive login lockout 5 failed attempts → temporary 30s+ lock keyed on the client IP. The client IP used for this limiter is taken from the X-9r-Real-Ip request header, which is intended to be set only by the bundled custom-server.js layer from the unspoofable TCP socket...

airCube Dashboard Login Panel - Detect

airCube Dashboard login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """airCube Dashboard login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'airCube Dashboard Login Panel -...

CVE-2026-12379

An Open Redirect vulnerability CWE-601 exists in the OAuth/OIDC authentication implementation of the Axivion Dashboard. The login flow did not properly restrict the post-authentication redirect to the application's own origin, so a user who follows a crafted login link can be sent to an untrusted...

CVE-2026-55501: Improper Restriction of Excessive Authentication Attempts

9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the attacker-controlled X-Forwarded-For HTTP header, and src/app/api/auth/login/route.js uses that spoofable value for checkLock and recordFail...

CVE-2025-9770 Campcodes Hospital Management System Admin Dashboard Login admin sql injection

A weakness has been identified in Campcodes Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ of the component Admin Dashboard Login. This manipulation of the argument Password causes sql injection. It is possible to initiate the attack...

CampCodes Hospital Management System security vulnerabilities

CampCodes Hospital Management System is a hospital management system from CampCodes, Inc. A security vulnerability exists in CampCodes Hospital Management System version 1.0, which originates from a SQL injection due to incorrect manipulation of the parameter Password in the component Admin...

CVE-2025-9770: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in Campcodes Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ of the component Admin Dashboard Login. This manipulation of the argument Password causes sql injection. It is possible to initiate the attack...

IBOS security vulnerabilities

IBOS is a collaborative office management system open-sourced by IBOS China. A security vulnerability exists in IBOS version 4.5.5, which stems from the existence of an arbitrary file deletion vulnerability that can be deleted via systemmodulesdashboardcontrollersLoginController.php...

CVE-2024-8959: Improper Neutralization of Input During Web Page Generation

The WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.1.6 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2022-9520

Name of the Vulnerable Software and Affected Versions Custom Dashboard & Login Page WordPress plugin versions prior to 7.0 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the plugin not sanitizing some of its settings, even when the unfiltered html...

CVE-2021-24944: Improper Neutralization of Input During Web Page Generation

The Custom Dashboard & Login Page WordPress plugin before 7.0 does not sanitise some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...