CVE-2023-24035

An issue was discovered in Nagios XI before 5.9.3. The isinsecureloginauthenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...

CVE-2023-24035

An issue was discovered in Nagios XI before 5.9.3. The isinsecureloginauthenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...

PT-2026-91766

A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/Login Model.php. This manipulation of the argument password/email/currentpassword/dbcurrentpwd/newpassword causes cleartext...

PT-2026-91179

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation...

PT-2026-91038

An issue was discovered in Nagios XI before 5.9.3. The is insecure login authenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...

EUVD-2023-60635

An issue was discovered in Nagios XI before 5.9.3. The isinsecureloginauthenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...

PT-2026-91095

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

PT-2026-91170

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3 user/yot3 pass causes sql injection. It is possible to initiate the attack remotely. The explo...

CVE-2026-80072

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing...

CVE-2026-80072

The User Registration & Membership WordPress plugin (versions before 5.2.8 ) contains an unauthenticated open redirect vulnerability. The plugin fails to validate the destination of a post-login redirect parameter, allowing an unauthenticated attacker to redirect a victim to an arbitrary external...

CVE-2026-80072 User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect Parameters

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing...

CVE-2026-80072 User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect Parameters

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing...

EUVD-2026-76953

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing...

PT-2026-90792

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing...

CVE-2026-77752

The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole...

CVE-2026-77753

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...

EUVD-2026-76800

The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account...

CVE-2026-87842

The Zonify – Amazon Product Importer for WooCommerce WordPress plugin prior to 1.0.5 fails to perform any capability or authentication check before returning the site's stored account login token . This allows unauthenticated attackers to retrieve the token and authenticate to the site owner's li...

CVE-2026-87842 Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure

The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account...

CVE-2026-87842 Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure

The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account...