CWE-799

Ascertia SigningHub do wersji 8.6.8 włącznie nie ogranicza liczby żądań resetowania hasła, co umożliwia atak email bombing. Uwierzytelniony atakujący może automatycznie wysyłać masowe żądania resetowania hasła pod wskazany adres e-mail.

Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.

This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoints which could lead to the OTP bombing/flooding on the targeted system.

An attacker may be able to cause a denial-of-service condition by sending many SSH packets repeatedly.

An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly.

This vulnerability exists in the CAP back office application due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted system.

Improper Control of Interaction Frequency vulnerability in MeWare Software Development Inc. PDKS allows Flooding. This issue affects PDKS: from V16.20200313 before VMYR_3.5.2025117.

Runtipi is a personal homeserver orchestrator. Prior to 4.8.1, The Runtipi /api/auth/verify-totp endpoint does not enforce any rate limiting, attempt counting, or account lockout mechanism. An attacker who has obtained a user's valid credentials (via phishing, credential stuffing, or data breach) can brute-force the 6-digit TOTP code to completely bypass two-factor authentication. The TOTP verification session persists for 24 hours (default cache TTL), providing an excessive window during which the full 1,000,000-code keyspace (000000–999999) can be exhausted. At practical request rates (~500 req/s), the attack completes in approximately 33 minutes in the worst case. This vulnerability is fixed in 4.8.1.

An Improper Control of Interaction Frequency vulnerability [CWE-799] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow a remote unauthenticated attacker to bypass the authentication rate-limit via crafted requests. The success of the attack depends on the attacker's resources and the password target complexity.

Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits (as as `AnonRateThrottle` or `UserRateThrottle`) was thus not rate limited on instances not having a memory cache backend configured. In the case of a default installation, this would notably include the rate-limits on the two factor codes. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5, or 22.2.0. As a workaround, enable a memory cache backend in `config.php`.

Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability

Improper Control of Interaction Frequency vulnerability in MIA Technology Inc. Pizzy Library allows Flooding. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250.

This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted system.

This vulnerability exists in Shilpi Client Dashboard due to lack of rate limiting and Captcha protection for OTP requests in certain API endpoint. An unauthenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoints, which could lead to the OTP bombing on the targeted system.

phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can bypass CAPTCHA protection and submit unlimited questions directly, causing database pollution and triggering outgoing mail notifications.

OpenClaw przed wersją 2026.3.31 nie posiada wspólnego budżetu pre-auth concurrency na publicznej ścieżce webhook LINE, co pozwala atakującym na spowodowanie przejściowej utraty dostępności. Zdalni atakujący mogą zalewać endpoint webhook równoczesnymi żądaniami przed weryfikacją sygnatury, aby wyczerpać zasoby i zdegradować dostępność usługi.

wpDiscuz przed wersją 7.6.47 zawiera podatność związaną z brakiem limitowania szybkości, która pozwala nieuwierzytelnionym atakującym na zarejestrowanie dowolnych adresów e-mail do powiadomień o postach poprzez wysyłanie żądań POST do handlera wpdAddSubscription w pliku class.WpdiscuzHelperAjax.php. Atakujący mogą wykorzystać znaki LIKE wildcard w zapytaniu subskrypcji, aby dopasować wiele adresów e-mail i wygenerować niechciane wiadomości powiadomień na kontach ofiar.

Parse Server to otwarty backend, który może być wdrażany na dowolną infrastrukturę obsługującą Node.js. W wersjach poprzedzających 9.5.2-alpha.10 i 8.6.23, middleware limitowania szybkości żądań jest stosowany na warstwie Express middleware, jednak endpoint żądań wsadowych (/batch) przetwarza pod-żądania wewnętrznie poprzez bezpośrednie kierowanie przez Promise router, omijając Express middleware, w tym limitowanie szybkości. Atakujący może zestawić wiele żądań skierowanych do chronionego endpoint'u w jedno żądanie wsadowe, aby obejść skonfigurowany limit szybkości. Podatne są wszystkie wdrażania Parse Server'a, które polegają na wbudowanej funkcji limitowania szybkości. Podatność została naprawiona w wersjach 9.5.2-alpha.10 i 8.6.23.

Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are Newsletter: Double Opt-in set to active, Newsletter: Double opt-in for registered customers set to disabled, and Log-in & sign-up: Double opt-in on sign-up set to disabled. With these settings, anyone can register an account on the shop using any e-mail-address and then check the check-box in the account page to sign up for the newsletter. The recipient will receive two mails confirming registering and signing up for the newsletter, no confirmation link needed to be clicked for either. In the backend the recipient is set to “instantly active”. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17.

Authentication Bypass by Assumed-Immutable Data vulnerability in Digital Operation Services WiFiBurada allows Manipulating User-Controlled Variables. This issue affects WiFiBurada: before 1.0.5.