Monthly
Unauthenticated attackers can take over accounts on Course Tencent Cloud versions 2.0.1 and earlier by brute-forcing 6-digit SMS/email verification codes that are never invalidated or attempt-limited. Exploitation requires knowledge of the victim's registered phone number or email address and rotation of source IPs to bypass per-IP rate limiting, as the codes have no per-account attempt counter. No public exploit code or active exploitation has been identified at time of analysis.
Password-recovery brute force in MacCMS v10 (through 2026.1000.4056) lets unauthenticated remote attackers take over member accounts: the six-digit reset code is never rate-limited, so anyone who knows a victim member's registered email address or phone number can request a code and repeatedly submit guesses to findpass_reset until the correct value is found, then overwrite the member's password. Because no attempt cap, lockout, or backoff is enforced, a 1,000,000-value code space becomes brute-forceable within the code's validity window, though the attacker must already know the target identifier and the impact is confined to member (non-administrator) accounts. Assessed as high severity (published CVSS 4.0 base 9.1; independent 3.1 assessment AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact); there is no CISA KEV entry and no dedicated exploit tooling confirmed, although a public technical writeup documents the brute-force technique.
Lychee photo-management instances running versions prior to 7.6.1 expose POST /api/v2/Album::unlock with no throttle, attempt counter, backoff, CAPTCHA, or lockout, letting remote unauthenticated attackers (CVSS PR:N, no user interaction) automate password guessing against password-protected albums. Successful recovery of an album password grants access to that album's otherwise private photo collection, so the realistic impact is concentrated on albums secured with weak or common passwords, since high-entropy passwords resist brute-forcing even with unlimited attempts. The fix is available in Lychee 7.6.1, which adds rate-limiting middleware to the unlock route; no public exploit is identified at time of analysis, and exploitation is bounded by the need to know or obtain a valid album identifier and by the strength of the album password.
Online second-factor guessing against FileRise releases prior to 3.23.0 is permitted well beyond the intended limit because failed TOTP verification attempts are recorded only in the PHP session rather than in a durable account-wide budget. An attacker who already possesses a valid primary credential (username plus password) for an account with TOTP enabled can abandon the pending login, start a fresh session, or change source address to restore the five-attempt allowance and continue guessing time-based codes indefinitely. Exploitation therefore has a hard precondition - the primary credential - and each guess remains a probabilistic online attempt against a rotating code, but a successful guess yields full account compromise; the vendor addressed the flaw in v3.23.0 and no public exploit code has been identified at time of analysis.
Unauthenticated attackers can take over Databasus accounts, including administrator accounts, by exploiting an authentication bypass in versions 3.7.0 through 3.61.0. The flaw allows brute-forcing six-digit password reset codes via POST /api/v1/users/reset-password because the application lacks rate limiting, account lockout, and code invalidation after failed attempts. No public exploit code has been identified at time of analysis, and while the flaw is high severity, real-world priority is tempered by the product's limited deployment footprint and absence of active exploitation signals.
FreeRDP 3.0.0 through 3.31.x allows a malicious RDP server to brute-force the smartcard PIN of a connecting client by resetting the per-handle retry counter in the virtual smartcard GIDS implementation. The attack requires the victim to initiate an RDP session to an attacker-controlled server while smartcard redirection is configured (UI:P/UI:R), and no public exploit code has been identified at time of analysis. This is a moderate-priority confidentiality issue (CVSS 4.0 7.1; independent CVSS 3.1 rates impact as C:H only) that can lead to PIN disclosure but not code execution or integrity/availability impact.
Account takeover in PHPNuxBill through 2025.3.20 allows unauthenticated remote attackers who know a valid customer username to brute-force the six-digit otp_code in the customer password-reset flow at system/controllers/forgot.php; because the pre-patch code has no attempt limit or lockout, an attacker can guess the OTP within its roughly 600-second validity window and then read the newly set password from the HTTP response. The vendor has published an upstream fix and advisory, but no public exploit identified at time of analysis, and the independent assessment rates this as a genuine high-priority issue requiring only a known username and default configuration.
Weak authentication throttling in Dell Secure Connect Gateway (SCG) Policy Manager allows unauthenticated remote attackers to mount sustained credential-guessing attacks against the login interface, potentially leading to privilege elevation, bypass of protection mechanisms, and unauthorized access to a management platform that brokers connectivity into managed Dell infrastructure. All SCG Policy Manager builds prior to the fixed release are affected (the Dell advisory cites 5.34.00.16, while ENISA EUVD data cites 5.36.00.16 - the discrepancy should be verified against the vendor advisory before patching decisions). The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and CWE-307, but exploitability is gated by credential strength and attempt volume: CISA's SSVC assessment rates it as not automatable and records no observed exploitation, EPSS is only 0.26% (16th percentile), and no public exploit code has been identified at time of analysis.
Two-factor authentication bypass in pH7Builder (pH7 Social Dating CMS) before 18.5.0 lets attackers who already know a valid account password brute-force the 6-digit TOTP code submitted to VerificationCodeFormProcess.php without any attempt throttling, ultimately taking over member, affiliate, or administrator accounts. Exploitation is second-order: it requires prior credential compromise (PR:L) plus 2FA enabled on the target account, and success depends on racing the OTP rotation window (AT:P), but when those conditions hold nothing stops unlimited guesses. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has shipped a fix in version 18.5.0 that reuses the existing per-IP login-attempt lockout.
Two-factor authentication bypass through brute force affects PLANKA 2.2.0 through 2.2.1: the POST /api/access-tokens/verify-totp endpoint imposes no limit on incorrect TOTP submissions, so an attacker who already holds a user's password can replay the same ten-minute pending token and guess six-digit codes until one is accepted, receiving a full access token. Exploitation is gated on possessing the victim's password (first factor) and the account having TOTP enabled, and the assessed CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - materially lower real-world risk than the headline 9.1 (CVSS 4.0) score, which assumes PR:N. There is no public exploit identified at time of analysis and no confirmed active exploitation; the vendor fix is an upstream commit that destroys the pending session after repeated failures and adds per-IP and per-identifier rate limiting.
Unauthenticated attackers can take over accounts on Course Tencent Cloud versions 2.0.1 and earlier by brute-forcing 6-digit SMS/email verification codes that are never invalidated or attempt-limited. Exploitation requires knowledge of the victim's registered phone number or email address and rotation of source IPs to bypass per-IP rate limiting, as the codes have no per-account attempt counter. No public exploit code or active exploitation has been identified at time of analysis.
Password-recovery brute force in MacCMS v10 (through 2026.1000.4056) lets unauthenticated remote attackers take over member accounts: the six-digit reset code is never rate-limited, so anyone who knows a victim member's registered email address or phone number can request a code and repeatedly submit guesses to findpass_reset until the correct value is found, then overwrite the member's password. Because no attempt cap, lockout, or backoff is enforced, a 1,000,000-value code space becomes brute-forceable within the code's validity window, though the attacker must already know the target identifier and the impact is confined to member (non-administrator) accounts. Assessed as high severity (published CVSS 4.0 base 9.1; independent 3.1 assessment AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact); there is no CISA KEV entry and no dedicated exploit tooling confirmed, although a public technical writeup documents the brute-force technique.
Lychee photo-management instances running versions prior to 7.6.1 expose POST /api/v2/Album::unlock with no throttle, attempt counter, backoff, CAPTCHA, or lockout, letting remote unauthenticated attackers (CVSS PR:N, no user interaction) automate password guessing against password-protected albums. Successful recovery of an album password grants access to that album's otherwise private photo collection, so the realistic impact is concentrated on albums secured with weak or common passwords, since high-entropy passwords resist brute-forcing even with unlimited attempts. The fix is available in Lychee 7.6.1, which adds rate-limiting middleware to the unlock route; no public exploit is identified at time of analysis, and exploitation is bounded by the need to know or obtain a valid album identifier and by the strength of the album password.
Online second-factor guessing against FileRise releases prior to 3.23.0 is permitted well beyond the intended limit because failed TOTP verification attempts are recorded only in the PHP session rather than in a durable account-wide budget. An attacker who already possesses a valid primary credential (username plus password) for an account with TOTP enabled can abandon the pending login, start a fresh session, or change source address to restore the five-attempt allowance and continue guessing time-based codes indefinitely. Exploitation therefore has a hard precondition - the primary credential - and each guess remains a probabilistic online attempt against a rotating code, but a successful guess yields full account compromise; the vendor addressed the flaw in v3.23.0 and no public exploit code has been identified at time of analysis.
Unauthenticated attackers can take over Databasus accounts, including administrator accounts, by exploiting an authentication bypass in versions 3.7.0 through 3.61.0. The flaw allows brute-forcing six-digit password reset codes via POST /api/v1/users/reset-password because the application lacks rate limiting, account lockout, and code invalidation after failed attempts. No public exploit code has been identified at time of analysis, and while the flaw is high severity, real-world priority is tempered by the product's limited deployment footprint and absence of active exploitation signals.
FreeRDP 3.0.0 through 3.31.x allows a malicious RDP server to brute-force the smartcard PIN of a connecting client by resetting the per-handle retry counter in the virtual smartcard GIDS implementation. The attack requires the victim to initiate an RDP session to an attacker-controlled server while smartcard redirection is configured (UI:P/UI:R), and no public exploit code has been identified at time of analysis. This is a moderate-priority confidentiality issue (CVSS 4.0 7.1; independent CVSS 3.1 rates impact as C:H only) that can lead to PIN disclosure but not code execution or integrity/availability impact.
Account takeover in PHPNuxBill through 2025.3.20 allows unauthenticated remote attackers who know a valid customer username to brute-force the six-digit otp_code in the customer password-reset flow at system/controllers/forgot.php; because the pre-patch code has no attempt limit or lockout, an attacker can guess the OTP within its roughly 600-second validity window and then read the newly set password from the HTTP response. The vendor has published an upstream fix and advisory, but no public exploit identified at time of analysis, and the independent assessment rates this as a genuine high-priority issue requiring only a known username and default configuration.
Weak authentication throttling in Dell Secure Connect Gateway (SCG) Policy Manager allows unauthenticated remote attackers to mount sustained credential-guessing attacks against the login interface, potentially leading to privilege elevation, bypass of protection mechanisms, and unauthorized access to a management platform that brokers connectivity into managed Dell infrastructure. All SCG Policy Manager builds prior to the fixed release are affected (the Dell advisory cites 5.34.00.16, while ENISA EUVD data cites 5.36.00.16 - the discrepancy should be verified against the vendor advisory before patching decisions). The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and CWE-307, but exploitability is gated by credential strength and attempt volume: CISA's SSVC assessment rates it as not automatable and records no observed exploitation, EPSS is only 0.26% (16th percentile), and no public exploit code has been identified at time of analysis.
Two-factor authentication bypass in pH7Builder (pH7 Social Dating CMS) before 18.5.0 lets attackers who already know a valid account password brute-force the 6-digit TOTP code submitted to VerificationCodeFormProcess.php without any attempt throttling, ultimately taking over member, affiliate, or administrator accounts. Exploitation is second-order: it requires prior credential compromise (PR:L) plus 2FA enabled on the target account, and success depends on racing the OTP rotation window (AT:P), but when those conditions hold nothing stops unlimited guesses. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has shipped a fix in version 18.5.0 that reuses the existing per-IP login-attempt lockout.
Two-factor authentication bypass through brute force affects PLANKA 2.2.0 through 2.2.1: the POST /api/access-tokens/verify-totp endpoint imposes no limit on incorrect TOTP submissions, so an attacker who already holds a user's password can replay the same ten-minute pending token and guess six-digit codes until one is accepted, receiving a full access token. Exploitation is gated on possessing the victim's password (first factor) and the account having TOTP enabled, and the assessed CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - materially lower real-world risk than the headline 9.1 (CVSS 4.0) score, which assumes PR:N. There is no public exploit identified at time of analysis and no confirmed active exploitation; the vendor fix is an upstream commit that destroys the pending session after repeated failures and adds per-IP and per-identifier rate limiting.