CVE-2026-40485 ChurchCRM: Username Enumeration via Differential Response in Public Login API

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint /api/public/user/login returns distinguishable HTTP response codes based on whether a username exists: 404 for non-existent users and 401 for valid users with incorrect passwords. An...

Masa CMS 安全漏洞

Masa CMS is a digital experience platform. A security vulnerability exists in Masa CMS v7.2, 7.3, and 7.4-beta that stems from its Remember Me feature that allows attackers to bypass authentication via a crafted web request...