openCRX-CVE-2020-7378

openCRX-CVE-2020-7378 비인증 계정 탈취 OpenCRX의 비밀번호 재설정 취약점CVE-2020-7378을 악용합니다. CVE-2020-7378을 위한 은밀한 Python 구현 이 취약점이 발생하는 이유는 개발자들이 사용자의 비밀번호를 재설정하기 위해 임의 토큰을 생성할 때 java.util.Random의 Random 클래스를 사용했기 때문입니다 대신 임의 토큰을 생성할 때 java.security.SecureRandom의 SecureRandom 클래스를 사용해야 합니다 v4.2.0에서 테스트되었으며,...

java-insecure-random-cve-2021-27568

java-insecure-random-cve-2021-27568 CVE-2021-27568 데모: 토큰 생성에서의 불안전한 무작위성...

CVE-2026-64964

ATutor (open-source learning management system) is vulnerable to predictable email confirmation token generation in its account confirmation functionality. The root cause is the use of insufficiently random values tied to user registration, allowing an attacker who can predict these values to gue...

CVE-2026-9323

The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and t...

CVE-2026-10530 Pie Register < 3.8.4.10 - Unauthenticated Email Verification Bypass via Predictable Token

The Pie Register WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, allowing unauthenticated attackers to predict a valid token and activate an account without access to the associated email inbox...

CVE-2026-10530

The CVE-2026-10530 entry concerns the WordPress Pie Register plugin prior to 3.8.4.10, where account verification tokens are generated with insufficient randomness. This allows an unauthenticated attacker to predict a valid token and activate a user account without access to the associated email ...

CVE-2026-41505

RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to predictable token generation in auth.py's makesigninkey function and exam.py's genticketcode function. This issue has been patched via commit 2f68e16...

CVE-2026-44054

Netatalk 2.0.0 through 4.4.2 generates AFP session tokens derived from predictable process IDs, which allows a remote authenticated attacker to cause a denial of service by exploiting the reconnect mechanism...

CVE-2026-41505

RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to predictable token generation in auth.py's makesigninkey function and exam.py's genticketcode function. This issue has been patched via commit 2f68e16...

CVE-2026-41505 RELATE: Predictable Token Generation in auth.py and exam.py

RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to predictable token generation in auth.py's makesigninkey function and exam.py's genticketcode function. This issue has been patched via commit 2f68e16...

EUVD-2026-28379

RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to predictable token generation in auth.py's makesigninkey function and exam.py's genticketcode function. This issue has been patched via commit 2f68e16...

RELATE 安全特征问题漏洞

RELATE is a web-based course package developed by Andreas Klöckner as an individual project. Previous versions of RELATE, such as 2f68e16, had security-related vulnerabilities. These vulnerabilities stemmed from the makesigninkey function in auth.py and the genticketcode function in exam.py, whic...

PT-2026-38443

RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to predictable token generation in auth.py's make sign in key function and exam.py's gen ticket code function. This issue has been patched via commit 2f68e16...

CVE-2026-40496

CVE-2026-40496 affects FreeScout prior to version 1.8.213, where attachment download tokens were created with a weak formula: md5(APP_KEY + attachment_id + size). Because attachment_id is sequential and size brute-forcible, an unauthenticated attacker can forge valid tokens and download private a...

CVE-2026-32742 Parse Server session creation endpoint allows overwriting server-generated session fields

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.17 and 8.6.42, an authenticated user can overwrite server-generated session fields sessionToken, expiresAt, createdWith when creating a session object via POST...

CVE-2025-40931

Apache::Session::Generate::MD5 (versions through 1.94 for Perl) creates insecure session IDs. The default generator returns a MD5 hash seeded with the built-in rand(), the epoch time, and the PID; the PID comes from a small set, and the epoch time may be guessed if not leaked. Built-in rand() is ...

CVE-2025-40931

Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come fro...

CVE-2025-13079

The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.2. This is due to the plugin generating predictable unsubscribe tokens using deterministic data. This makes it...

CVE-2025-13079

CVE-2025-13079 concerns the WordPress plugin “Popup Builder” (versions

CVE-2025-13079 Popup Builder - Create highly converting, mobile friendly marketing popups. <= 4.4.2 - Improper Authorization to Unauthenticated Subscriber Removal via Predictable Tokens

The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.2. This is due to the plugin generating predictable unsubscribe tokens using deterministic data. This makes it...