CVE-2026-93868

Cotonti through 1.0.0 derives password recovery validation tokens from md5microtime in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow...

EUVD-2026-83365

Cotonti through 1.0.0 derives password recovery validation tokens from md5microtime in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow...

CVE-2026-93868

Cotonti through 1.0.0 uses md5(microtime()) to generate password recovery validation tokens in users.passrecover.php, yielding a predictable token space of roughly one million values per second. An unauthenticated attacker can read the server Date header, precompute candidate tokens within a narr...

CVE-2026-93868 Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG

Cotonti through 1.0.0 derives password recovery validation tokens from md5microtime in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow...

CVE-2026-93868: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Cotonti through 1.0.0 derives password recovery validation tokens from md5microtime in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow...

Use of a Broken or Risky Cryptographic Algorithm in froxlor/froxlor

Description Froxlor uses microtime to seed uniqid which is then hashed to produce a session token, microtime can be reasonably brute-forced/predicted, thus allowing for a relatively large-scale account-takeover attack or accurate targeted ones. Both microtime and uniqid are cryptographically...

CVE-2019-19735

class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes based only on microtime, which allows an attacker to guess the hash and set the password within a few hours by bruteforcing...

Design/Logic Flaw

class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes based only on microtime, which allows an attacker to guess the hash and set the password within a few hours by bruteforcing...

LinPHA <= 1.3.1 (new_images.php) Remote Blind SQL Injection Exploit

No description provided by source. ?php / LinPHA = 1.3.1 newimages.php Remote Blind SQL Injection Hash Fishing Exploit / BENCHMARK method author...: EgiX mail.....: n0b0d1esathotmaildotcom link.....: http://linpha.sourceforge.net/ dork.....: LinPHA Version 1.3.x or The LinPHA developers vulnerabl...