353 matches found
Musicbox WordPress - Reflected XSS
contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13327 info:...
CVE-2026-105624
The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues via repeated...
CVE-2026-105671
The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests...
EUVD-2026-125455
The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues via repeated...
EUVD-2026-125443
The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests...
CVE-2026-41940-cPanel-WHM-Verification-Tool
CVE-2026-41940 cPanel & WHM Verification Tool This repository contains a Python verification script for CVE-2026-41940, a critical authentication bypass vulnerability disclosed in cPanel & WHM. This project is intended for authorized defensive validation only. It is not intended for exploit...
PT-2026-146940
The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests...
PT-2026-146938
The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues via repeated...
EEF-CVE-2026-119446 Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token
Summary Session Fixation vulnerability in the CLI login flow in nerves-hub nerveshubweb allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/clisession needs no authentication and returns a polling...
CVE-2026-119446 Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token
Session Fixation vulnerability in the CLI login flow in nerves-hub nerveshubweb allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/clisession needs no authentication and returns a polling token, a...
CVE-2026-119446 Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token
Session Fixation vulnerability in the CLI login flow in nerves-hub nerveshubweb allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/clisession needs no authentication and returns a polling token, a...
CVE-2026-119446
The nerves-hub nerves_hub_web component (versions 2.5.0 to 2.5.2 ) is vulnerable to a Session Fixation vulnerability in its CLI login flow. An unauthenticated attacker can initiate a login via POST /api/auth/cli_session to receive a polling token and a confirmation URL. By persuading a signed-in ...
keycloak-services: keycloak-services: Residual cross-browser account-link proof allows silent re-linking
A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...
CVE-2026-123271
ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same...
CVE-2026-123271 ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator
ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same...
CVE-2026-123271
ChatCLI versions prior to v1.215.2 are vulnerable to an improper validation flaw in the MCP OAuth login flow . The application fails to verify that the server-supplied Protected Resource Metadata matches the configured server URL when used as a resource indicator. An attacker operating a maliciou...
EUVD-2026-117724
ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same...
CVE-2026-123271
ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same...
CVE-2026-112208
A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiat...
EUVD-2026-117568
A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiat...