3311 matches found
CVE-2026-45010
phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session binding or rate limiting. Unauthenticated attackers can brute-force any user's six-digit TOTP code by...
PT-2026-44707
Name of the Vulnerable Software and Affected Versions Drupal TFA Basic Plugins versions 7.x-1.0 through 7.x-1.2 Description An access bypass issue allows users possessing the administer users permission to view or generate recovery codes for other users. Recommendations Update Drupal TFA Basic...
Drupal TFA Basic Plugins 安全漏洞
Drupal TFA Basic Plugins is a set of Drupal two-factor authentication extensions developed by the Drupal company. Versions 7.x-1.0 to 7.x-1.2 of Drupal TFA Basic Plugins contain security vulnerabilities. These vulnerabilities stem from access bypass issues, which could allow users with...
Debian dla-4602 : lemonldap-ng - security update
The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4602 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4602-1 [email protected]...
USN-8315-1: MediaWiki vulnerabilities
It was discovered that MediaWiki incorrectly handled group membership visibility in the OATHAuth extension. An authenticated attacker could use this issue to determine if other users had two-factor authentication enabled. CVE-2026-34087 It was discovered that MediaWiki incorrectly handled...
USN-8315-1 mediawiki vulnerabilities
It was discovered that MediaWiki incorrectly handled group membership visibility in the OATHAuth extension. An authenticated attacker could use this issue to determine if other users had two-factor authentication enabled. CVE-2026-34087 It was discovered that MediaWiki incorrectly handled...
CVE-2026-8903
The CVE concerns the WordPress plugin “Two-factor authentication (formerly IP Vault)” up to version 2.1. It is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation in ipv_save_changes. This allows unauthenticated attackers to modify the plugin’s firewall and two-f...
CVE-2026-8903 Two-factor authentication (formerly IP Vault) <= 2.1 - Cross-Site Request Forgery to Settings Update
The Two-factor authentication formerly IP Vault plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the ipvsavechanges function. This makes it possible for unauthenticated attackers to...
EUVD-2026-32073
The Two-factor authentication formerly IP Vault plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the ipvsavechanges function. This makes it possible for unauthenticated attackers to...
CVE-2026-8903 Two-factor authentication (formerly IP Vault) <= 2.1 - Cross-Site Request Forgery to Settings Update
The Two-factor authentication formerly IP Vault plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the ipvsavechanges function. This makes it possible for unauthenticated attackers to...
CVE-2026-8903: Cross-Site Request Forgery (CSRF)
The Two-factor authentication formerly IP Vault plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the ipvsavechanges function. This makes it possible for unauthenticated attackers to...
WordPress plugin Two-factor authentication 跨站请求伪造漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
WordPress Two-factor authentication (formerly IP Vault) plugin <= 2.1 - Cross-Site Request Forgery to Settings Update vulnerability
Cross-Site Request Forgery to Settings Update vulnerability discovered by afnaan - SMKN 1 Bantul in WordPress Plugin IP Vault – WP Firewall versions = 2.1...
CVE-2026-48896
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2026-48897
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2026-48897
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2026-48896
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2026-48896
CVE-2026-48896 affects Joomla! Core MFA authentication, caused by insufficient state checks that allow bypassing 2FA. The CVE entry cites a 2FA bypass vector with high impact ( Confidentiality/Integrity/Availability as noted in the CVSS data: integrity impact HIGH, others NONE/NEGLIGIBLE). Connec...
