Ruoyi-Vue-Pro - Unauthenticated Admin Takeover via Predictable SMS Code

ruoyi-vue-pro Yudao ships base configuration yudao.sms-code.begin-code=end-code=9999, so every generated SMS verification code is the constant "9999" in all profiles. The anonymous SMS-login flow therefore grants an access token to any account whose mobile number is known: send-sms-code followed ...

CVE-2026-4235

A weakness has been identified in itsourcecode Online Enrollment System 1.0. This issue affects some unknown processing of the file /sms/login.php. This manipulation of the argument useremail causes sql injection. The attack is possible to be carried out remotely. The exploit has been made...

CVE-2025-1475

The WPCOM Member plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.5. This is due to insufficient verification on the 'userphone' parameter when logging in. This makes it possible for unauthenticated attackers to log in as any existing user on t...

EUVD-2025-7400

Malicious code in bioql PyPI...

CVE-2025-1475

The WPCOM Member plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.5. This is due to insufficient verification on the 'userphone' parameter when logging in. This makes it possible for unauthenticated attackers to log in as any existing user on t...

CVE-2025-1475 WPCOM Member <= 1.7.5 - Authentication Bypass via 'user_phone'

The WPCOM Member plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.5. This is due to insufficient verification on the 'userphone' parameter when logging in. This makes it possible for unauthenticated attackers to log in as any existing user on t...

CVE-2025-1475 WPCOM Member <= 1.7.5 - Authentication Bypass via 'user_phone'

The WPCOM Member plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.5. This is due to insufficient verification on the 'userphone' parameter when logging in. This makes it possible for unauthenticated attackers to log in as any existing user on t...

CVE-2025-1475: Improper Authentication

The WPCOM Member plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.5. This is due to insufficient verification on the 'userphone' parameter when logging in. This makes it possible for unauthenticated attackers to log in as any existing user on t...

PT-2025-10045

Name of the Vulnerable Software and Affected Versions WPCOM Member plugin for WordPress versions up to and including 1.7.5 Description The issue is related to authentication bypass due to insufficient verification on the user phone parameter when logging in. This allows unauthenticated attackers ...