CVE-2025-15474

AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy BLE range to cause a denial of service by repeatedly initiating BLE connections. Sustained connection attempts interrupt keypad...

PT-2026-1557

Name of the Vulnerable Software and Affected Versions AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 Description The AuntyFey Smart Combination Lock firmware is susceptible to a denial of service. An unauthenticated attacker within Bluetooth Low Energy BLE range can repeatedly...

Improper Control of Interaction Frequency

Overview django-phone-verify is an A Django app to support phone number verification using security code sent via SMS. Affected versions of this package are vulnerable to Improper Control of Interaction Frequency due to the absence of failed attempt tracking and lockout mechanisms in the...

Password Enumeration

Liferay Portal is vulnerable to password enumeration. The vulnerability is due to insufficient protection against brute-force attempts, which allows an attacker to systematically guess and determine a user’s password even when account lockout mechanisms are enabled...

CVE-2025-34410

1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery CSRF vulnerability in the Change Username functionality available from the settings panel /settings/panel. The endpoint does not implement CSRF protections such as anti-CSRF tokens or Origin/Referer validation. An attacker can...

1Panel contains a cross-site request forgery (CSRF) vulnerability in the Change Username functionality

1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery CSRF vulnerability in the Change Username functionality available from the settings panel /settings/panel. The endpoint does not implement CSRF protections such as anti-CSRF tokens or Origin/Referer validation. An attacker can...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the Change Username process in the settings panel. An attacker can cause a user's account to be locked out by tricking the victim into visiting a malicious webpage while authenticated, which submits a...

CVE-2025-34410 1Panel CSRF in Change Username Functionality Allows Account Lockout

1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery CSRF vulnerability in the Change Username functionality available from the settings panel /settings/panel. The endpoint does not implement CSRF protections such as anti-CSRF tokens or Origin/Referer validation. An attacker can...

CVE-2025-34410 1Panel CSRF in Change Username Functionality Allows Account Lockout

1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery CSRF vulnerability in the Change Username functionality available from the settings panel /settings/panel. The endpoint does not implement CSRF protections such as anti-CSRF tokens or Origin/Referer validation. An attacker can...

CVE-2025-34410 1Panel CSRF in Change Username Functionality Allows Account Lockout

1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery CSRF vulnerability in the Change Username functionality available from the settings panel /settings/panel. The endpoint does not implement CSRF protections such as anti-CSRF tokens or Origin/Referer validation. An attacker can...

CVE-2025-34410

1Panel versions 1.10.33–2.0.15 have a CSRF in Change Username under /settings/panel. The endpoint lacks anti-CSRF tokens and Origin/Referer checks, enabling an attacker to submit a username-change request via a malicious page while the victim is authenticated. The victim’s username can be changed...

1Panel contains a cross-site request forgery (CSRF) vulnerability in the Change Username functionality

1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery CSRF vulnerability in the Change Username functionality available from the settings panel /settings/panel. The endpoint does not implement CSRF protections such as anti-CSRF tokens or Origin/Referer validation. An attacker can...

1Panel 跨站请求伪造漏洞

1Panel is an open source Linux server operation and management panel from China's 1Panel community. A cross-site request forgery vulnerability exists in 1Panel versions 1.10.33 through 2.0.15. The vulnerability stems from the change username feature not implementing CSRF protection, which could...

PT-2025-50339

Name of the Vulnerable Software and Affected Versions 1Panel versions 1.10.33 through 2.0.15 Description 1Panel versions 1.10.33 through 2.0.15 are affected by a cross-site request forgery CSRF issue in the Change Username functionality, accessible through the settings panel at the /settings/pane...

Security Bulletin: IBM® Db2® is vulnerable to users regaining access without admin help after account lockout (CVE-2025-33012)

Summary IBM® Db2® is vulnerable to allowing an authenticated user to regain access after account lockout due to password use after expiration date. Vulnerability Details CVEID:CVE-2025-33012 DESCRIPTION: IBM Db2 for Linux could allow an authenticated user to regain access after account lockout du...

CVE-2025-42615

In affected versions, vulnerability-lookup did not track or limit failed One-Time Password OTP attempts during Two-Factor Authentication 2FA verification. An attacker who already knew or guessed a valid username and password could submit an arbitrary number of OTP codes without causing the accoun...

CVE-2025-42615

In affected versions, vulnerability-lookup did not track or limit failed One-Time Password OTP attempts during Two-Factor Authentication 2FA verification. An attacker who already knew or guessed a valid username and password could submit an arbitrary number of OTP codes without causing the accoun...

CVE-2025-42615

Summary: CVE-2025-42615 affects Vulnerability-Lookup prior to 2.18.0 and stems from failing to rate-limit OTP attempts during 2FA, enabling brute-force style OTP submissions by an attacker with valid credentials. The concrete fix adds a persistent failed_otp_attempts counter, locks a user after 5...

EUVD-2025-201703

In affected versions, vulnerability-lookup did not track or limit failed One-Time Password OTP attempts during Two-Factor Authentication 2FA verification. An attacker who already knew or guessed a valid username and password could submit an arbitrary number of OTP codes without causing the accoun...

CVE-2025-42615 Improper Restriction of Excessive Authentication Attempts vulnerability in CIRCL Vulnerability-Lookup

In affected versions, vulnerability-lookup did not track or limit failed One-Time Password OTP attempts during Two-Factor Authentication 2FA verification. An attacker who already knew or guessed a valid username and password could submit an arbitrary number of OTP codes without causing the accoun...