MAL-2025-2033 Malicious code in checkout-one-time-payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b07c8dfeaf38da871c1e555b86d76046f4752bc738bf14ed15147cdadb6d92ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in checkout-one-time-payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b07c8dfeaf38da871c1e555b86d76046f4752bc738bf14ed15147cdadb6d92ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-1570 Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP

The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 8.1. This is due to the directoristgeneratepasswordresetpincode and resetuserpassword functions...

WordPress Directorist plugin <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP vulnerability

Privilege Escalation and Account Takeover via Weak OTP vulnerability discovered by wesley wcraft in WordPress Plugin Directorist versions = 8.1...

Veeam My Account Portal - MFA Guide

Veeam Data Cloud MFA Requirements As of July 7, 2026, logging in to Veeam Data Cloud cloud.veeam.com using the Continue with Veeam authentication option now requires that your Veeam Account have Multi-Factor Authentication MFA enabled. If you use the Continue with Microsoft authentication option,...

CVE-2025-1629

A vulnerability was found in Excitel Broadband Private my Excitel App 3.13.0 on Android. It has been classified as problematic. Affected is an unknown function of the component One-Time Password Handler. The manipulation leads to improper restriction of excessive authentication attempts. The vend...

CVE-2025-1629

CVE-2025-1629 affects Excitel Broadband Private my Excitel App for Android (version 3.13.0). The issue resides in an unknown function of the One-Time Password Handler, causing improper restriction of excessive authentication attempts. Reported by multiple sources (NVD/Red Hat/CVE listings) with v...

CVE-2025-1629 Excitel Broadband Private my Excitel App One-Time Password excessive authentication

A vulnerability was found in Excitel Broadband Private my Excitel App 3.13.0 on Android. It has been classified as problematic. Affected is an unknown function of the component One-Time Password Handler. The manipulation leads to improper restriction of excessive authentication attempts. The vend...

CVE-2025-1629 Excitel Broadband Private my Excitel App One-Time Password excessive authentication

A vulnerability was found in Excitel Broadband Private my Excitel App 3.13.0 on Android. It has been classified as problematic. Affected is an unknown function of the component One-Time Password Handler. The manipulation leads to improper restriction of excessive authentication attempts. The vend...

PT-2025-7701 · Excitel Broadband Private · My Excitel App

Name of the Vulnerable Software and Affected Versions: Excitel Broadband Private my Excitel App version 3.13.0 Description: A vulnerability was found in the One-Time Password Handler component, leading to improper restriction of excessive authentication attempts. The vendor was contacted about th...

How Phished Data Turns into Apple & Google Wallets

Carding -- the underground business of stealing, selling and swiping stolen payment card data -- has long been the dominion of Russia-based hackers. Happily, the broad deployment of more secure chip-based payment cards in the United States has weakened the carding market. But a flurry of innovati...

Rupeeseed RupeeWeb 安全漏洞

Rupeeseed RupeeWeb is a state-of-the-art web-based trading platform from Rupeeseed India. Rupeeseed RupeeWeb suffers from a security vulnerability that stems from a flaw in the OTP authentication mechanism that allows bypassing two-factor authentication...

Rupeeseed RupeeWeb 安全漏洞

Rupeeseed RupeeWeb is a state-of-the-art web-based trading platform from Rupeeseed India. A security vulnerability exists in Rupeeseed RupeeWeb that stems from a lack of rate limiting on the API endpoints, allowing an authenticated, remote attacker to send multiple OTP requests, resulting in OTP...

PT-2025-7176 · Rupeeweb · Rupeeweb

Name of the Vulnerable Software and Affected Versions: RupeeWeb trading platform affected versions not specified Description: This issue exists due to improper implementation of the OTP validation mechanism in certain API endpoints. A remote attacker with valid credentials could exploit this by...

PT-2025-7178 · Rupeeweb · Rupeeweb

Name of the Vulnerable Software and Affected Versions: RupeeWeb trading platform affected versions not specified Description: The issue is caused by missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker could exploit this by sending multiple OTP requests...

CVE-2024-6637

The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the...

CVE-2024-12857

The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.8. This is due to the plugin not properly verifying a user's identity prior to logging them in as that user. This makes it possible for unauthenticated attackers to authenticate as an...

PT-2025-1970 · WordPress · Adforest

Name of the Vulnerable Software and Affected Versions: AdForest theme for WordPress versions up to, and including, 5.1.8 Description: The AdForest theme for WordPress is vulnerable to authentication bypass due to the plugin not properly verifying a user's identity prior to logging them in as that...

Scammers Impersonate Authorities to Swipe OTPs with Remote Access Apps

SUMMARY Cybersecurity researchers at Group-IB have discovered a sophisticated refund scam where scammers are using remote access tools…...

The vulnerability of the One-Time Password function of the operating system for managing Synology Router Manager devices allows a hacker to delete any files they want.

The vulnerability of the One-Time Password function in the operating system for managing Synology Router Manager devices is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to delete any files they want...