CVE-2026-63149

Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword using PHP's uniqid function based on server time in microseconds. Attackers who observe or approximate the...

CVE-2026-63149 Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()

Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword using PHP's uniqid function based on server time in microseconds. Attackers who observe or approximate the...

CVE-2026-63149 Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()

Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword using PHP's uniqid function based on server time in microseconds. Attackers who observe or approximate the...

CVE-2026-63149 Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()

Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword using PHP's uniqid function based on server time in microseconds. Attackers who observe or approximate the...

EUVD-2026-100563

Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword using PHP's uniqid function based on server time in microseconds. Attackers who observe or approximate the...

CVE-2026-63149

The Omnispace Agora Project versions prior to 26.10.0 are vulnerable to an insecure randomness flaw. The issue stems from the use of PHP's uniqid() function within Txt::defaultPassword() to generate temporary or default account passwords. Because uniqid() is based on the server time in microsecon...

CVE-2026-63149: Use of Insufficiently Random Values

Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword using PHP's uniqid function based on server time in microseconds. Attackers who observe or approximate the...

PT-2026-113330

Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword using PHP's uniqid function based on server time in microseconds. Attackers who observe or approximate the...

CVE-2026-96599

Isotope eCommerce through 2.9.10 derives order identifiers from uniqid instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer...

CVE-2026-96599

Versions of Isotope eCommerce through 2.9.10 are vulnerable to an identifier prediction flaw. The application uses the uniqid() function rather than a cryptographically secure source to generate order identifiers. Because guest orders lack proper ownership verification, an unauthenticated attacke...

CVE-2026-92912

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel creation time can brute-force the...

CVE-2026-92912 AVideo Cryptographically Weak PRNG via uniqid Stream Key

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel creation time can brute-force the...

CVE-2026-92912 AVideo Cryptographically Weak PRNG via uniqid Stream Key

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel creation time can brute-force the...

EUVD-2026-81434

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel creation time can brute-force the...

CVE-2026-92912

AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) uses cryptographically weak uniqid() values for RTMP publish keys in its LiveTransmition module. This reduces key entropy to approximately one million possibilities per creation second, allowing an attacker who knows the channel cre...

CVE-2026-92912 AVideo Cryptographically Weak PRNG via uniqid Stream Key

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel creation time can brute-force the...

CVE-2026-46493

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use uniqid for generating salts, which is unsuitable. Version 26.0.1 fixes the issue...

CVE-2026-46493

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use uniqid for generating salts, which is unsuitable. Version 26.0.1 fixes the issue...

CVE-2026-46493 haxtheweb/haxcms-php uses insecure method for generating salt

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use uniqid for generating salts, which is unsuitable. Version 26.0.1 fixes the issue...

CVE-2026-46493

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use uniqid for generating salts, which is unsuitable. Version 26.0.1 fixes the issue...