PT-2025-39238

Name of the Vulnerable Software and Affected Versions Web Application affected versions not specified Description The web application has a flaw that allows an unauthenticated remote attacker to gather information about existing user accounts, including their roles, due to a lack of authenticatio...

CVE-2025-58434

Flowise was vulnerable in versions up to 3.0.5 where the forgot-password API returned a valid tempToken and other sensitive user data without authentication, enabling an unauthenticated attacker to reset passwords and take over accounts (including admins). A fix was released in version 3.0.6 that...

User Enumeration

com.liferay, com.liferay.login.web is vulnerable to User Enumeration. The vulnerability is due to improper handling of account creation requests on the "create account" page, which allows an attacker to determine if a specific account exists in the application...

Sensitive Information Disclosure

Liferay Portal is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper access control due to weak validation in the calendar feature, which allows authenticated users to enumerate other users’ calendars and use this information for phishing attacks...

Linux Distros Unpatched Vulnerability : CVE-2023-22359

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - User enumeration in Checkmk =2.2.0p4 allows an authenticated attacker to enumerate usernames. CVE-2023-22359 Note that Nessus relies on the presence of the...

Linux Distros Unpatched Vulnerability : CVE-2020-27740

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Citadel WebCit through 926 allows unauthenticated remote attackers to enumerate valid users within the platform. NOTE: this was reported to the vendor in a...

CVE-2025-58442 Saleor has user enumeration vulnerability due to different error messages

Saleor is an e-commerce platform. Starting in version 3.21.0 and prior to version 3.21.16, requesting certain fields in the response of accountRegister may result in errors that could unintentionally reveal whether a user with the provided email already exists in Saleor. Version 3.21.16 fixes the...

CVE-2025-58442 Saleor has user enumeration vulnerability due to different error messages

Saleor is an e-commerce platform. Starting in version 3.21.0 and prior to version 3.21.16, requesting certain fields in the response of accountRegister may result in errors that could unintentionally reveal whether a user with the provided email already exists in Saleor. Version 3.21.16 fixes the...

CVE-2025-58442

CVE-2025-58442 affects Saleor’s accountRegister API. From 3.21.0 up to 3.21.15, certain field requests in the response may trigger error handling that can reveal whether a given email is already registered, enabling user enumeration. The issue is resolved in 3.21.16. Workarounds include rate-limi...

CVE-2025-9824

ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. PatchesThis vulnerability has been patched, implementing a timing-safe form login...

ROS-20250905-07

A vulnerability in the user locking mechanism of the Vault Enterprise and Vault Community Edition enterprise data archiving platforms is due to the application not performing the correct normalization of the application. Enterprise and Vault Community Edition is related to the fact that the...

Information Disclosure

omeroweb is vulnerable to information disclosure. The vulnerability is due to error messages displayed during the Forgot Password reset process disclosing user information, which allows an attacker to enumerate or gain insights about valid users...

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.

...

CVE-2025-46047

A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid usernames via the Login parameter...

[20250902] - Core - User-Enumeration in passkey authentication method

Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method...

GHSA-3GGV-QWCP-J6XG Mautic Vulnerable to User Enumeration via Response Timing

Impact The attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. Patches This vulnerability has been patched, implementing a timing-safe form login...

Mautic Vulnerable to User Enumeration via Response Timing

Impact The attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. Patches This vulnerability has been patched, implementing a timing-safe form login...

CVE-2025-9824 User Enumeration via Response Timing

ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. PatchesThis vulnerability has been patched, implementing a timing-safe form login...

CVE-2025-9824 User Enumeration via Response Timing

ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. PatchesThis vulnerability has been patched, implementing a timing-safe form login...

CVE-2025-9824

The CVE-2025-9824 issue stems from different login response times for existing versus non-existent users in Mautic, enabling user enumeration and potential brute-force attempts. Technical details describe that valid usernames trigger password hashing while invalid ones do not; the fix adds a Timi...