15699 matches found
CVE-2025-62844 QuRouter
A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to gain sensitive information. We have already fixed the vulnerability in the following version: QuRouter 2.6.2.007 and later...
CVE-2025-62844
CVE-2025-62844 describes a weak authentication vulnerability affecting QHora/QuRouter where an attacker with local network access can exploit the issue to obtain sensitive information. According to connected sources, the vulnerability impacts authentication mechanisms and allows confidential data...
Improper Access Control
code.gitea.io/gitea is vulnerable to improper access control. The vulnerability is due to insufficient authorization checks, which allows an anonymous attacker to access private user projects...
CVE-2026-33124
Frigate (NVR) prior to version 0.17.0-beta1 allows any authenticated user to change their own password without providing the current password via /users/{username}/password. Affected component: password change functionality; root cause includes lack of current-password verification and no passwor...
CVE-2026-33041 AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php
WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/encryptPass.json.php exposes the application's password hashing algorithm to any unauthenticated user. An attacker can submit arbitrary passwords and receive their hashed equivalents, enabling offline password...
CVE-2026-33041 AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php
WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/encryptPass.json.php exposes the application's password hashing algorithm to any unauthenticated user. An attacker can submit arbitrary passwords and receive their hashed equivalents, enabling offline password...
CVE-2026-33041
WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/encryptPass.json.php exposes the application's password hashing algorithm to any unauthenticated user. An attacker can submit arbitrary passwords and receive their hashed equivalents, enabling offline password...
CVE-2026-33037
WWBN AVideo is an open source video platform. In versions 25.0 and below, the official Docker deployment files docker-compose.yml, env.example ship with the admin password set to "password", which is automatically used to seed the admin account during installation, meaning any instance deployed...
CVE-2026-33037 WWBN AVideo has predictable default admin credentials in official Docker deployment path
WWBN AVideo is an open source video platform. In versions 25.0 and below, the official Docker deployment files docker-compose.yml, env.example ship with the admin password set to "password", which is automatically used to seed the admin account during installation, meaning any instance deployed...
QNAP Systems QHora ๅฎๅ จๆผๆด
QNAP Systems QHora is a router product of QNAP Systems, a company based in Taiwan, China. QNAP Systems QHora has a security vulnerability that stems from weak authentication procedures. This vulnerability could allow attackers with access to the local network to obtain sensitive information...
WWBN AVideo ๅฎๅ จๆผๆด
WWBN AVideo is a video platform building system written in PHP, developed by the WWBN team. Versions of WWBN AVideo 25.0 and earlier contained security vulnerabilities. These vulnerabilities stemmed from the default administrator password being a weak one, along with the use of MD5 hashing, which...
PT-2026-26565
WWBN AVideo is an open source video platform. In versions 25.0 and below, the official Docker deployment files docker-compose.yml, env.example ship with the admin password set to "password", which is automatically used to seed the admin account during installation, meaning any instance deployed...
PT-2026-26634
Name of the Vulnerable Software and Affected Versions QHora versions prior to 2.6.2.007 Description A weak authentication issue exists in QHora. An attacker with local network access can exploit this to obtain sensitive information. Recommendations Update to version 2.6.2.007 or later...
๐ PEGA Infinity Brute Force / Insecure Direct Object Reference
PEGA Infinity suffers from brute forcing and insecure direct object reference vulnerabilities. Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by the brute force issue. Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by the idor issue. SEC Consult Vulnerability Lab...
OpenClaw Information Disclosure Vulnerability (CNVD-2026-14389)
OpenClaw is openclaw open source an intelligent artificial assistant. OpenClaw has an information disclosure vulnerability, the vulnerability stems from the component File Existence Handler's function tools.exec.safeBins for the protection of sensitive information is insufficient, an attacker can...
Exploit for Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Openssl
๐ SSH Exploit Tool Educational Use Only ๐ Description Th...
web-app-security-project
๐ก๏ธ Web Application Security Project ๐ Overview This projec...
EUVD-2026-12643
IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and administrative functionalities due to lack of proper access controls...
CVE-2026-1267
IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and administrative functionalities due to lack of proper access controls...
Weak Authentication
Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Weak Authentication in the user sign up. An attacker can create authenticated sessions without providing valid credentials b...