25167 matches found
EUVD-2025-35668
Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks...
Tibbo AggreGate Network Manager 安全漏洞
Tibbo AggreGate Network Manager is a network monitoring and IT management platform from Tibbo. A security vulnerability exists in Tibbo AggreGate Network Manager versions prior to 6.40.05, which stems from an observable response discrepancy in the login function that could lead to user enumeratio...
Moodle 安全漏洞
Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle that stems from mobile and web service authentication endpoints that do not...
PT-2025-43447
Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description The authentication endpoints for Moodle’s mobile and web services did not adequately limit repeated password attempts, leaving them open to brute-force attacks. The vulnerable endpoints are th...
EUVD-2025-35362
In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system...
CVE-2025-11809 WP-Force Images Download <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The WP-Force Images Download plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpfid' shortcode in all versions up to, and including, 1.8. This is due to insufficient input sanitization and output escaping on the 'class' attribute. This makes it possible for authenticated...
CVE-2025-11809
CVE-2025-11809 refers to the WP-Force Images Download plugin for WordPress (versions up to 1.8). The issue is a Stored XSS via the wpfid shortcode caused by insufficient input sanitization/output escaping on the class attribute. Exploitation requires attacker with contributor+ privileges; the pay...
WordPress plugin WP-Force Images Download cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...
SUSE CVE-2025-40005
In the Linux kernel, the following vulnerability has been resolved: spi: cadence-quadspi: Implement refcount to handle unbind during busy driver support indirect read and indirect write operation with assumption no force device removalunbind operation. However force device removalremoval is still...
WordPress WP-Force Images Download plugin <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin WP-Force Images Download versions = 1.8...
CVE-2025-56224
A lack of rate limiting in the One-Time Password OTP verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack...
CVE-2025-56221
A lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a brute force attack...
AZL-78380 CVE-2025-40005 affecting package kernel 5.15.200.1-1
In the Linux kernel, the following vulnerability has been resolved: spi: cadence-quadspi: Implement refcount to handle unbind during busy driver support indirect read and indirect write operation with assumption no force device removalunbind operation. However force device removalremoval is still...
EUVD-2025-35049
A lack of rate limiting in the One-Time Password OTP verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack...
CVE-2025-40005
In the Linux kernel, the following vulnerability has been resolved: spi: cadence-quadspi: Implement refcount to handle unbind during busy driver support indirect read and indirect write operation with assumption no force device removalunbind operation. However force device removalremoval is still...
CVE-2025-40005 spi: cadence-quadspi: Implement refcount to handle unbind during busy
In the Linux kernel, the following vulnerability has been resolved: spi: cadence-quadspi: Implement refcount to handle unbind during busy driver support indirect read and indirect write operation with assumption no force device removalunbind operation. However force device removalremoval is still...
CVE-2025-56224
A lack of rate limiting in the One-Time Password OTP verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack...
CVE-2025-56224
A lack of rate limiting in the One-Time Password OTP verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack...
CVE-2025-56224
CVE-2025-56224 concerns SigningHub v8.6.8, where a lack of rate limiting on the One-Time Password (OTP) verification endpoint enables brute-force bypass of verification. The Red Hat, NVD, ENISA EUVD, CIRCL, CNNVD and other feeds corroborate that the vulnerability allows bypassing OTP verification...