CVE-2026-100508

Unauthenticated Denial of Service Attack in Two Factor = 0.16.0 versions...

CVE-2026-100508 WordPress Two Factor plugin <= 0.16.0 - Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack in Two Factor = 0.16.0 versions...

CVE-2026-100508

The WordPress Two Factor plugin versions

EUVD-2026-89938

Unauthenticated Denial of Service Attack in Two Factor = 0.16.0 versions...

WordPress Two Factor plugin <= 0.16.0 - Denial of Service Attack vulnerability

Denial of Service Attack vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Two Factor versions = 0.16.0...

2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424

2FA Bypass Using a Brute Force Attack Overview The Nagios Fusion application version 2024R1.2 and 2024R2 is vulnerable to a Brute-Force attack on its Two-Factor Authentication 2FA mechanism. Specifically, the 2FA implementation does not adequately enforce rate-limiting or account lockout...

Linux Distros Unpatched Vulnerability : CVE-2026-53628

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth,...

CVE-2024-10924

CVE-2024-10924 Omisión de Autenticación en Really Simple Security Free, Pro y Pro Multisite 9.0.0 – 9.1.1.1 Descripción Los plugins Really Simple Security Free, Pro y Pro Multisite para WordPress son vulnerables a la omisión de autenticación en las versiones 9.0.0 a 9.1.1.1. Esto se debe a un...

CVE-2024-10924

POC for CVE-2024-10924 An error handling flaw in the REST API of the Really Simple Plugins WordPress plugin versions between 9.0.0 and 9.1.1.1 included allows an attacker, when Two-Factor Authentication is enabled, to bypass authentication and take control of an existing user or administrator...

wordpress-really-simple-security-authn-bypass-vulnerable-application

wordpress-really-simple-security-authn-bypass-vulnerable-application This is a vulnerable application to test the exploit for the Really Simple Security 9.1.2 authentication bypass CVE-2024-10924. WARNING! This application contains serious security vulnerabilities. Run it at your own risk! It is...

CVE-2024-10924

Exploit for CVE-2024-10924 WordPress Really Simple Security Plugin - Authentication Bypass 📌 Overview CVE-2024-10924 is a critical authentication bypass vulnerability in the Really Simple Security plugin for WordPress versions 9.0.0 to 9.1.1.1. This vulnerability allows unauthenticated attackers ...

wordpress-really-simple-security-authn-bypass-exploit

wordpress-really-simple-security-authn-bypass-exploit This is a Python3 program that exploits Really Simple Security 9.1.2 authentication bypass vulnerability CVE-2024-10924. DISCLAIMER This tool is intended for security engineers and appsec people for security assessments. Please use this tool...

CVE-2024-10924-Exploit

CVE-2024-10924-Exploit Really Simple Security Free, Pro, and Pro Multisite 9.0.0 - 9.1.1.1 - Authentication Bypass 📖 Description This script exploits a vulnerability in the Really Simple Security plugin versions 9.0.0 - 9.1.1.1 for WordPress.The flaw allows authentication bypass due to improper...

CVE-2024-10924-Wordpress-Docker

CVE-2024-10924 : Wordpress Really Simple Security authentication bypass flaw in Docker Description The Really Simple Security plugins Free, Pro, and Pro Multisite for WordPress, versions 9.0.0 to 9.1.1.1, are affected by an authentication bypass vulnerability. This issue arises from improper erro...

CVE-2026-100712

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...

CVE-2026-100667

grav-plugin-login the Grav CMS Login plugin versions = 3.8.7 and 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated Twig function or the authenticated shortcode. On sites with 2FA enabled, Login::isAuthenticated checked only the session flag...

CVE-2026-100712 froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...

CVE-2026-100712 froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...

EUVD-2026-87685

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...

CVE-2026-100712

The froxlor software (versions through 2.3.10 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack that disables a user's two-factor authentication (2FA) . The root cause is that the 2FA management page (e.g., /customer_index.php?page=2fa&action=delete) responds to unauthenticated-trigge...