Limit Login Attempts WordPress - Stored Cross-site Scripting

Limit Login Attempts WordPress plugin 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context. id: CVE-2021-24657 info: name:...

Limit Login Attempts - Stored Cross-Site Scripting

Limit Login Attempts WordPress plugin 4.0.72 contains a stored cross-site scripting caused by unsanitized and unescaped settings, letting malicious administrators inject Javascript code, exploit requires administrator privileges. id: CVE-2022-1029 info: name: Limit Login Attempts - Stored...

UhOh365

UhOh365 Office365でメールアドレスが有効かどうかを確認できるスクリプトです。ログイン試行は一切行わず、レート制限もなく、ソーシャルエンジニアリング評価において、どのメールが存在し、どのメールが存在しないかを調べるのに非常に役立ちます。 Microsoftは「メール列挙」を脆弱性とは見なしていないため、これは「機能」を利用したものです。他にもいくつか公開されているOffice365メール検証スクリプトがありますが、（私が見た限りでは）すべて少なくとも1回のログイン試行をユーザーアカウントごとに必要とします。それは検出可能...

CVE-2026-93616_Checks

安装 将 compromise-check.sh 移动到 Check Point 管理服务器 chmod +x compromise-check.sh Shell 脚本 在 Check Point 管理服务器上以 Expert 模式运行这些命令，从包含 compromise-check.sh 的目录中执行。 SmartDashboard 脚本 smartdashboardrunscript.sh 可以直接从 smartdashboard 运行，方法是进入管理器并点击运行脚本，然后粘贴此代码。 描述 此脚本用于查找添加的 python 脚本、登录尝试以及某些 IP 地址段。...

CVE-2020-35590

漏洞利用信息 漏洞标题： WordPress 插件 Limit Login Attempts Reloaded 2.13.0 - 登录限制绕过 CVE： CVE-2020-35590 日期： 2020-06-09 漏洞作者： N4nj0 软件链接： https://wordpress.org/plugins/limit-login-attempts-reloaded/ 版本： 2.13.0 测试环境： WordPress 5.4.1, 5.4.2 漏洞公告：...

CVE-2023-4800

CVE 编号: CVE-2023-4800 漏洞类型: 敏感数据暴露 描述: 适用于 WordPress 的 DoLogin Security 插件在 3.7 及更早版本中，由于仪表盘小工具缺少权限检查，存在未授权访问数据的漏洞。这使得已认证的攻击者能够查看登录尝试日志。 复现步骤: 启用插件，并以授权用户身份导航到仪表盘。 参考: 1. https://wpscan.com/vulnerability/7eae1434-8c7a-4291-912d-a4a07b73ee56 2. https://vulners.com/cve/CVE-2023-4800 3...

CVE-2024-34070

CVE-2024-34070 Froxlor PoC CVE-2024-34070 的概念验证 Python 程序，针对 Froxlor 2.1.9 之前版本中通过写入系统日志的失败登录尝试导致的存储型 XSS 漏洞。 警告 本项目仅用于授权的安全测试、CTF 实验室和教育目的。请勿对你不拥有或未获得明确许可的系统运行此程序。漏洞利用模式可以在目标 Froxlor 实例上创建一个管理员账户。 功能 检测 Froxlor 实例。 当提供有效凭据时，从经过身份验证的管理员会话中提取 Froxlor 版本。 报告检测到的版本是否存在漏洞（ 2.1.9）。 注入存储型 XSS 载荷，创建新的管理...

CVE-2024-13184

CVE-2024-13184 终极WordPress工具包 – WP Extended = 3.0.12 - 通过登录尝试模块的未认证SQL注入 描述 终极WordPress工具包 – WP Extended 插件（WordPress 平台）在其登录尝试模块中存在基于时间的SQL注入漏洞，影响所有版本至 3.0.12（含）。该漏洞源于对用户提供的参数转义不足，且未能充分准备现有 SQL 查询。这使得未认证攻击者能够将额外的 SQL 查询附加到已有查询中，从而从数据库中提取敏感信息。 详情 类型 : 插件 插件标识 : wpextended 受影响版本 : 3.0.12 CVSS 评分 :...

CVE-2026-97764

django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics e.g., accents for a higher effective limit...

CVE-2026-92082

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see ...

CVE-2026-92082

Payara Server is vulnerable to brute-force login attacks because, by default, it does not limit the number of failed login attempts. The attack vector is adjacent network (AV:A) with low complexity and no privileges required, rated CVSS 4.0 6.3 (MEDIUM) with low confidential impact on the vulnera...

CVE-2026-92082 Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see ...

Astra Linux – Vulnerability in Zabbix

The Zabbix API’s user.get method returns all users that share a common group with the calling user. This includes media and other information, such as login attempts, etc...

CVE-2026-89174

The Smart Video Intercom System developed by Kingdom Communication Associated suffers from a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts by performing a large number of login attempts, resulting in a high confidentiality impact ...

CVE-2026-89174 Kingdom Communication Associated｜Smart Video Intercom System - Missing Burte-force Protection

Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts through a large number of login attempts...

WordPress Limit Login Attempts Security plugin < 3.3.5 - Username Denylist Bypass vulnerability

Username Denylist Bypass vulnerability discovered by Artus KG in WordPress Plugin Limit Login Attempts Reloaded versions 3.3.5...

CVE-2026-18356

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway...

EUVD-2026-63912

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway...

CVE-2026-18356 Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account Email

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway...

CVE-2026-18356

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 contains a bypass in its username denylist mechanism. The plugin fails to compare login attempts against the denylist case-insensitively and does not account for the account's email address , allowing an account that an administrator...