CVE-2026-91921

Cross-Site Scripting XSS vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax an...

CVE-2026-77771

CVE-2026-77771 — miniOrange 2FA 무료 및 Pro: 세션 범위 OTP 잠금을 통한 2FA 우회 WordPress용 miniOrange Two-Factor Authentication 플러그인의 인증 우회 취약점으로, 이미 피해자의 유효한 비밀번호를 보유한 공격자가 제한 없이 두 번째 인증 요소를 무차별 대입할 수 있어 2FA를 완전히 무력화할 수 있습니다. 요약 | ---|--- CVE ID| CVE-2026-77771 취약점 유형| 인증 우회 AUTHBYPASS CWE| CWE-287: 부적절한 인증...

CVE-2026-77771 miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...

CVE-2026-76213 phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle

phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt limit by obtaining a fresh session cook...