CVE-2026-112775

Craft CMS versions 5.0.0 before 5.11.0 are vulnerable to an authentication bypass due to verification code reuse . The root cause is that the users/verify-email endpoint fails to invalidate codes for active users. An attacker who obtains a victim's emailed code can submit it to users/set-password...

PT-2023-31228 · Doracms · Doracms

Name of the Vulnerable Software and Affected Versions: DoraCMS version 2.1.8 Description: The issue allows attackers to gain access to the application via a bruteforce attack due to the re-use of the same code for verification of valid usernames and passwords. Recommendations: For DoraCMS version...