CVE-2026-15206 SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...

CVE-2023-42571

Abuse of remote unlock in Find My Mobile prior to version 7.3.13.4 allows physical attacker to unlock the device remotely by resetting the Samsung Account password with SMS verification when user lost the device...

LeEco Zero Pie Enjoy Android app has an arbitrary account login vulnerability

ZeroPai Lexiang is an electric car time-share rental platform launched by LeTV Group. There is an arbitrary account login vulnerability in the Android app of LeTV ZeroPai Lexian. Due to design flaws in the cell phone SMS verification code login function, cracking the sign signature algorithm lead...

Arbitrary Account Login Vulnerability in Dingtone Travel App

Dingtone Travel APP is a new energy car sharing platform based on internet technology. A design flaw vulnerability exists in the Dingtone Mobility Android APP's cell phone SMS verification code login function, allowing attackers to exploit the vulnerability to log in to another person's account...

Arbitrary Password Reset Vulnerability in ZTE E Academy APP

ZTE E Academy APP is a professional skills learning software. There is an arbitrary password reset vulnerability in ZTE E Academy APP IOS version and Android version. By using a cell phone number to retrieve the password when the SMS verification code is returned directly to the response, you onl...