43161 matches found
CVE-2026-7820 pgAdmin 4: Account-lockout bypass via Flask-Security default /login view
Improper restriction of excessive authentication attempts CWE-307 in pgAdmin 4. pgAdmin enforces MAXLOGINATTEMPTS only inside its custom /authenticate/login view. Flask-Security's default /login view, which is registered automatically by security.initapp and is reachable on every server, never...
PT-2026-39752
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.33.0, a stored cross-site scripting XSS vulnerability exists in the Login Page due to improper sanitization of the authLoginCustomMessage field of the /api/auth-settings endpoint. An attacker with administrative privileges c...
CVE-2026-38567: Improper Neutralization of Special Elements used in an SQL Command
HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints. User-supplied input is concatenated directly into SQL queries without parameterization. An unauthenticated attacker can bypass authentication by supplying a crafted username e.g. admin'-- or extract the full content...
CVE-2025-65415
docuFORM Managed Print Service Client 11.11c is vulnerable to a session fixation attack via the login page of the application...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: gdm (UTSA-2026-017683)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017683 advisory. A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could bypass the lock screen by selecting the timed...
Vaultwarden 安全漏洞
Vaultwarden is an alternative implementation of the Bitwarden server API, developed by Daniel García. Versions of Vaultwarden prior to 1.35.4 contained a security vulnerability. This vulnerability stemmed from the fact that enabling email two-factor authentication allowed bypassing login...
PT-2026-39864
Name of the Vulnerable Software and Affected Versions Vaultwarden versions prior to 1.35.4 Description A flaw in the login brute-force protection allows attackers to determine if a username and password combination is correct when email two-factor authentication 2FA is enabled. The API endpoint...
HireFlow 安全漏洞
HireFlow is an online interview management platform developed by StratonWebDesigners as a personal developer project. Version 1.2 of HireFlow contains a security vulnerability. This vulnerability stems from the direct concatenation of user inputs into SQL queries through endpoints like /login and...
CVE-2025-65417
The docuFORM Managed Print Service Client (version 11.11c ) is vulnerable to a reflected cross-site scripting (XSS) attack. The flaw originates from the login page of the application, where improper neutralization of input during web page generation allows an attacker to reflect malicious scripts...
CVE-2025-65417: Improper Neutralization of Input During Web Page Generation
docuFORM Managed Print Service Client 11.11c is vulnerable to a reflected cross site scripting attack via the login page of the application...
CVE-2025-65415: Session Fixation
docuFORM Managed Print Service Client 11.11c is vulnerable to a session fixation attack via the login page of the application...
CVE-2026-42613: Improper Input Validation
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation. When registration is enabled and groups or access are included in the...
Audiobookshelf 跨站脚本漏洞
Audiobookshelf is an open-source, self-hosted server for audio books and podcasts. Versions of Audiobookshelf prior to 2.33.0 had a cross-site scripting vulnerability. This vulnerability occurred due to the login page not properly cleaning the authLoginCustomMessage field, allowing for...
CVE-2026-38567
HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints. User-supplied input is concatenated directly into SQL queries without parameterization. An unauthenticated attacker can bypass authentication by supplying a crafted username e.g. admin'-- or extract the full content...
CVE-2025-65417
docuFORM Managed Print Service Client 11.11c is vulnerable to a reflected cross site scripting attack via the login page of the application...
docuForm FSM Server 授权问题漏洞
The docuForm FSM Server is a server-side system developed by the German company docuForm, designed for enterprise document processing and form workflow management. The version 11.11c of the docuForm FSM Server has an authorization vulnerability, which stems from a session fixation attack present ...
CVE-2025-65417
docuFORM Managed Print Service Client 11.11c is vulnerable to a reflected cross site scripting attack via the login page of the application...
CVE-2026-38567
HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints. User-supplied input is concatenated directly into SQL queries without parameterization. An unauthenticated attacker can bypass authentication by supplying a crafted username e.g. admin'-- or extract the full content...
CVE-2026-38567
HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints because user-supplied input is concatenated directly into SQL queries without proper parameterization. An unauthenticated attacker can exploit this to bypass authentication by using a crafted username (e.g., admin'--...