PortSwigger Web Security: Out of scope: Improper Input Validation Order on /api-internal/login via password field leads to unnecessary resource consumption

A security issue was discovered in the /api-internal/login authentication endpoint of the internal login interface of Burp Suite DAST Enterprise. The issue was caused by improper input validation order, where the application processed user-supplied input before enforcing field-level validation...

CVE-2026-33132 ZITADEL is missing enforcement of organization scopes

ZITADEL is an open source identity management platform. Versions prior to 3.4.9 and 4.0.0 through 4.12.2 allowed users to bypass organization enforcement during authentication. Zitadel allows applications to enforce an organzation context during authentication using scopes urn:zitadel:iam:org:id:...

com.abavilla:fpi-bot-api (>=1.5.1, <=1.5.4), com.abavilla:fpi-bot-api-parent (>=1.5.1, <=1.5.4) +52 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (21.0.1)

org.keycloak:keycloak-adapter-core MAVEN version 21.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - com.abavilla:fpi-bot-api =1.5.1, =1.5.1, =1.7.0, =1.7.0, =1.5.2, =1.5.2, =1.7.2, =1.7.2,...

1Panel – CAPTCHA Bypass via Client-Controlled Flag

Summary A CAPTCHA bypass vulnerability in the 1Panel authentication API allows an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections could be bypassed,...

GHSA-QMG5-V42X-QQHQ 1Panel – CAPTCHA Bypass via Client-Controlled Flag

Summary A CAPTCHA bypass vulnerability in the 1Panel authentication API allows an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections could be bypassed,...

EUVD-2021-24829

Malware in sbrugna...

EUVD-2023-33908

Malicious code in bioql PyPI...

CVE-2024-47530

Scout is a web-based visualizer for VCF-files. Open redirect vulnerability allows performing phishing attacks on users by redirecting them to malicious page. /login API endpoint is vulnerable to open redirect attack via next parameter due to absence of sanitization logic. Additionally, due to lac...

CVE-2024-49358

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint http:///v1/users/login in ZimaOS returns distinct responses based on whether a username exists or the password is incorrect. This behavior can b...

CVE-2023-2418

A vulnerability was found in Konga 2.8.3 on Kong. It has been classified as problematic. This affects an unknown part of the component Login API. The manipulation leads to insufficiently random values. The complexity of an attack is rather high. The exploitability is told to be difficult. The...

CVE-2021-38376

OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call...

GHSA-4G8M-5MJ5-C8XG Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

Impact Based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists. Patches Patched in 10.8.10 and 13.8.1. Workarounds None available...

CVE-2025-46736: Observable Response Discrepancy

Umbraco is a free and open source .NET content management system. Prior to versions 10.8.10 and 13.8.1, based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists. The issue is patched in versions 10.8.10 and 13.8.1. No known workarounds a...

Malware in swift-login-api

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-587 Malicious code in swift-login-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbad853440515e1762a39bb7b7d5a115b77cf243fd0ee0b3bbd82c1ac8bab0c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in swift-login-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbad853440515e1762a39bb7b7d5a115b77cf243fd0ee0b3bbd82c1ac8bab0c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-36188 · Unknown · Aicomments

Name of the Vulnerable Software and Affected Versions: AIcomments versions 1.4.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user into...

PT-2024-33153 · Unknown · Best House Rental Management System Project In Php

Name of the Vulnerable Software and Affected Versions: Best House rental management system project in php version 1.0 Description: The issue allows a remote attacker to execute arbitrary code via the username parameter of the "login request" API endpoint. This enables the attacker to inject...

com.abavilla:fpi-bot-api (>=1.5.1, <=1.5.4), com.abavilla:fpi-bot-api-parent (>=1.5.1, <=1.5.4) +125 more potentially affected by CVE-2024-7318 via org.keycloak:keycloak-core (21.0.1)

org.keycloak:keycloak-core MAVEN version 21.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.abavilla:fpi-bot-api =1.5.1, =1.5.1, =1.7.0, =1.7.0, =1.5.2, =1.5.2, =1.7.2, =1.7.2, =1.0.22, =1.0.22,...

Open Redirect

scoutbrowser is vulnerable to Open Redirect. The vulnerability is due to inadequate input validation and sanitization in the /login API endpoint, which does not properly handle the next parameter, and lack of scheme validation, which allows for both open redirects and HTTPS downgrade attacks...