CVE-2026-86187

WWBN AVideo generates passwords for external-login accounts using rand instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing...

CVE-2021-42665

CVE-2021-42665 CVE-2021-42665 - SQL Injection authentication bypass vulnerability in the Engineers online portal system. Technical description: An SQL Injection vulnerability exists in the Engineers Online Portal login form which can allow an attacker to bypass authentication. Affected components...

CVE-2026-86184

Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APPENV is not production. Attackers can request the GET /screenshot-login/email endpoint with a registered emai...

EUVD-2026-72008

WWBN AVideo generates passwords for external-login accounts using rand instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing...

CVE-2026-86187

WWBN AVideo is vulnerable to password recovery via weak PRNG in its external-login account creation process. Passwords are generated using rand() rather than a cryptographically secure generator, yielding only 31-bit integers that are further weakened by unsalted MD5 hashing. An attacker with acc...

CVE-2026-86187 WWBN AVideo Weak PRNG Password Generation via External Login

WWBN AVideo generates passwords for external-login accounts using rand instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing...

CVE-2026-86187 WWBN AVideo Weak PRNG Password Generation via External Login

WWBN AVideo generates passwords for external-login accounts using rand instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing...

CVE-2026-86186

AVideo is a video hosting platform whose API rate-limiting mechanism fails to account for requests carrying a bot User-Agent header . This allows an unauthenticated attacker to bypass all eight protected operations , including login brute-force protection , by simply setting a bot User-Agent stri...

CVE-2026-86186 AVideo API Rate Limit Bypass via Bot User-Agent Header

AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing...

CVE-2026-86186 AVideo API Rate Limit Bypass via Bot User-Agent Header

AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing...

CVE-2026-86184

Lara Dashboard before 1.3.0 is affected by an authentication bypass in the screenshot-login route. When APP_ENV is not set to production, an unauthenticated attacker can request GET /screenshot-login/{email} with any registered email address to obtain a fully authenticated session. This grants ac...

EUVD-2026-71993

Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APPENV is not production. Attackers can request the GET /screenshot-login/email endpoint with a registered emai...

CVE-2026-86184 Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route

Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APPENV is not production. Attackers can request the GET /screenshot-login/email endpoint with a registered emai...

CVE-2025-7892-Proof-of-Concept-Login-Form

CVE-2025-7892-Proof-of-Concept-Login-Form Demonstration Video: https://drive.google.com/file/d/16vr563yC9ub3NQP-f63KL95v0ZLbX5O/view?usp=drivelink Credit : https://github.com/KMov-g...

CVE-2026-83628

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the tmlmssignuphandler function's gimmeanotherblog branch failing to enforce the network's activesignup registration policy, checking...

CVE-2026-83628

Theme My Login plugin for WordPress (versions

EUVD-2026-71840

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the tmlmssignuphandler function's gimmeanotherblog branch failing to enforce the network's activesignup registration policy, checking...

CVE-2026-83628 Theme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the tmlmssignuphandler function's gimmeanotherblog branch failing to enforce the network's activesignup registration policy, checking...

CVE-2026-64638

🛡️ CVE-2026-64638 - XSS2Shell WordPress Pre-Authentication Reflected XSS with potential escalation to PHP Code Execution 📌 Overview CVE-2026-64638 is a high-severity pre-authentication reflected Cross-Site Scripting XSS vulnerability affecting the WordPress login screen. Under specific conditions,...

CVE-2026-64638-WordPress-Core-XSS2Shell

CVE-2026-64638 — Nuclei Detection Template Template Nuclei for non-intrusive detection of XSS2Shell , a pre-authenticated differential parser in WordPress Core that allows injection of DOM elements into the login page, serving as the basis for an XSS → RCE chain. ⚠️ This template only detects the...