306 matches found
AVTECH DVR - Login Verification Code Bypass
AVTECH DVR products are vulnerable to verification code bypass just by entering the "login=quick" parameter to bypass verification code. id: CVE-2013-4982 info: name: AVTECH DVR - Login Verification Code Bypass author: ritikchaddha severity: low description: | AVTECH DVR products are vulnerable t...
CVE-2026-77799
ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code...
CVE-2026-120447 HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code
HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through...
CVE-2026-120447
The software HotGo through 2.15.1 is susceptible to an authentication bypass vulnerability. An unauthenticated attacker who knows a user's mobile number can supply a custom value to the Code field at the /admin/sms/send endpoint. By pre-setting a known verification code, the attacker can then sig...
CVE-2026-120447 HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code
HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through...
EUVD-2026-115207
HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through...
PT-2026-135463
Name of the Vulnerable Software and Affected Versions HotGo versions 2.0.0 through 2.15.1 Description An authentication bypass exists that allows unauthenticated attackers to set a custom SMS login verification code. By providing a specific value to the Code field at the '/admin/sms/send' endpoin...
CodeCatcher security vulnerability
Version 131 of CodeCatcher contains a security vulnerability stemming from improper permission settings. This vulnerability may allow unauthorized attackers to manipulate the application’s SMS verification code capture mechanism at will...
CVE-2026-105997
The Booking Package WordPress plugin (versions prior to 1.7.33 ) is vulnerable to a flaw where it fails to restrict who can trigger booking verification-code emails. Because the plugin does not bind the recipient to a server-side state, unauthenticated users can force the website to send template...
CVE-2026-105997 Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient
The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients...
EUVD-2026-111702
The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients...
CVE-2026-105997 Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient
The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients...
PT-2026-127819
The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients...
CVE-2026-105997: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code…
The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients...
CVE-2026-102813
An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effecti...
DataSunrise email code brute force unauth RCE
Brute-force 6-digit email verification code, reset admin password, login, and invoke runShellAction JSON-RPC over /webiface. !/usr/bin/env python3 -- coding: utf-8 -- """DataSunrise email verification code brute force → admin reset → runShellAction RCE.""" from future import annotations import...
TP-Link RE305 encryption issue vulnerability
Versions prior to TP-Link RE305 V3 1.1.8 Build 20260921 Rel. 42853 contain an encryption vulnerability. This vulnerability stems from an authentication flaw in the password recovery function. Additionally, the verification code interface lacks proper attempt counting or locking mechanisms;...
CVE-2026-112775 Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the...
CVE-2026-112775 Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the...
CVE-2026-112775 Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the...