Lucene search
+L

40383 matches found

PyPA
PyPA
•added 2026/08/04 11:34 a.m.•32 views

Open WebUI: Account enumeration via observable login timing discrepancy

SummaryThe /api/v1/auths/signin endpoint leaked whether an email address belonged to a registered account through a response-time side channel. Password verification ran bcrypt only when the email was found in the database; for a non-existent email the request returned early without hashing. The...

5.3CVSS5.5AI score0.00413EPSS
SaveExploits0References8Affected Software1
GithubExploit
GithubExploit
•added 2026/08/04 10:11 a.m.•55 views

Exploit for CVE-2026-17543

PHP CVE-2026-17543 Exposure Validator Safe network-side valid...

9.3CVSS5.8AI score0.0033EPSS
SaveExploits2
Vulnrichment
Vulnrichment
•added 2026/08/04 9:07 a.m.•10 views

CVE-2026-14202 Username Enumeration via Differential Login Responses in Bilin Software's HUMANIST Digital Human Resources

Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

5.3CVSS5.4AI score0.0033EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/08/04 9:07 a.m.•55 views

CVE-2026-14202 Username Enumeration via Differential Login Responses in Bilin Software's HUMANIST Digital Human Resources

Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

5.3CVSS0.0033EPSS
SaveExploits0References1
CVE
CVE
•added 2026/08/04 9:07 a.m.•65 views

CVE-2026-14202

Bilin Software’s HUMANIST Digital Human Resources (versions before 26.1) suffers a username enumeration flaw via observable differences in login responses, enabling account footprinting. CVSS 3.1 base score 5.3 (Network, Low attack complexity, No privileges, No user interaction). Exploitation sta...

5.3CVSS5.4AI score0.0033EPSS
SaveExploits0References1
NVD
NVD
•added 2026/08/04 4:16 a.m.•21 views

CVE-2026-18721

A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has be...

5.3CVSS0.00425EPSS
SaveExploits0References5
NVD
NVD
•added 2026/08/04 3:16 a.m.•15 views

CVE-2026-8508

An improper authentication vulnerability in the "sociallogin.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an attacker on the WLAN to bypass captive portal authentication...

6.5CVSS0.00317EPSS
SaveExploits1References1
EUVD
EUVD
•added 2026/08/04 2:30 a.m.•20 views

EUVD-2026-52570

A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has be...

5.3CVSS5.1AI score0.00425EPSS
SaveExploits0References5
CVE
CVE
•added 2026/08/04 1:57 a.m.•83 views

CVE-2026-8508

The CVE applies to Zyxel WAX650S devices with firmware up to 7.10(ABRM.4)C0, where the social_login.cgi CGI component performs improper authentication. This could allow a WLAN attacker to bypass captive portal authentication, implying an authentication bypass vulnerability in the device’s login f...

6.5CVSS5.5AI score0.00317EPSS
SaveExploits1References1
Vulnrichment
Vulnrichment
•added 2026/08/04 1:57 a.m.•9 views

CVE-2026-8508

An improper authentication vulnerability in the "sociallogin.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an attacker on the WLAN to bypass captive portal authentication...

6.5CVSS5.5AI score0.00317EPSS
SaveExploits1References1
Cvelist
Cvelist
•added 2026/08/04 1:57 a.m.•59 views

CVE-2026-8508

An improper authentication vulnerability in the "sociallogin.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an attacker on the WLAN to bypass captive portal authentication...

6.5CVSS0.00317EPSS
SaveExploits1References1
attackerkb
attackerkb
•added 2026/08/04 1:57 a.m.•14 views

CVE-2026-8508

An improper authentication vulnerability in the "sociallogin.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an attacker on the WLAN to bypass captive portal authentication...

6.5CVSS5.5AI score0.00317EPSS
SaveExploits1References2Affected Software1
EUVD
EUVD
•added 2026/08/04 1:57 a.m.•21 views

EUVD-2026-52567

An improper authentication vulnerability in the "sociallogin.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an attacker on the WLAN to bypass captive portal authentication...

6.5CVSS5.5AI score0.00317EPSS
SaveExploits1References1
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/08/04 12:00 a.m.•1 views

CVE-2026-18721: URL Redirection to Untrusted Site

A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has be...

5.3CVSS5AI score0.00425EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/08/04 12:00 a.m.•32 views

PT-2026-67634

Name of the Vulnerable Software and Affected Versions Zyxel WAX650S versions prior to 7.10ABRM.4C0 Description An improper authentication issue exists in the "social login.cgi" CGI program. This flaw allows an attacker connected to the WLAN to bypass captive portal authentication. Recommendations...

6.5CVSS6.4AI score0.00317EPSS
SaveExploits1References11
Positive Technologies
Positive Technologies
•added 2026/08/04 12:00 a.m.•30 views

PT-2026-67636

A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has be...

5.3CVSS5.1AI score0.00425EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/08/04 12:00 a.m.•14 views

PT-2026-67887

Name of the Vulnerable Software and Affected Versions Ghost versions 2.2.0 through 6.54.0 Description Ghost Admin fails to invalidate existing sessions during the login process, which could enable session fixation attacks. Session fixation is a method where an attacker provides a valid session...

6.7CVSS5.2AI score0.00244EPSS
SaveExploits0References12
SUSE CVE
SUSE CVE
•added 2026/08/03 11:50 p.m.•12 views

SUSE CVE-2026-17348

In SERVER mode, pgAdmin 4 enforces authentication per route via the @pgaloginrequired decorator; the application's beforerequest hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication...

6.9CVSS5.5AI score0.00422EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/03 8:17 p.m.•15 views

CVE-2026-18641

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignDP.DpLoginController of the file /fort/portallogin of the component Login Endpoint. This manipulation causes os command...

7.5CVSS0.02657EPSS
SaveExploits0References5
Cvelist
Cvelist
•added 2026/08/03 7:45 p.m.•55 views

CVE-2026-18641 Sangfor Operation and Maintenance Security Management System Login Endpoint portal_login com.sbr.fort.foreignDP.DpLoginController os command injection

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignDP.DpLoginController of the file /fort/portallogin of the component Login Endpoint. This manipulation causes os command...

7.5CVSS0.02657EPSS
SaveExploits0References5
Rows per page
Query Builder