CWE-307 · Improper Restriction of Excessive Authentication Attempts (page 3)
Page 3 of 7 — CVEs classified under CWE-307, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-49195 | Medium | 5.3 | 2025-06-12 | The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the… |
CVE-2025-49186 | Medium | 5.3 | 2025-06-12 | The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute… |
CVE-2025-5864 | Low | 3.7 | 2025-06-09 | A vulnerability was found in Tenda TDSEE App up to 1.7.12. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of t… |
CVE-2025-48014 | High | 7.5 | 2025-05-20 | Password guessing limits could be bypassed when using LDAP authentication. |
CVE-2025-48187 | Critical | 9.1 | 2025-05-17 | RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arb… |
CVE-2023-34732 | Medium | 5.4 | 2025-05-12 | An issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c allows attackers to execute brute force… |
CVE-2025-46739 | High | 8.1 | 2025-05-12 | An unauthenticated user could discover account credentials via a brute-force attack without rate limiting |
CVE-2025-20196 | Medium | 5.3 | 2025-05-07 | A vulnerability in the Cisco IOx application hosting environment of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacke… |
CVE-2025-3709 | Critical | 9.8 | 2025-05-02 | Agentflow from Flowring Technology has an Account Lockout Bypass vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to perf… |
CVE-2025-42600 | | 2025-04-23 | This vulnerability exists in Meon KYC solutions due to missing restrictions on the number of incorrect One-Time Password (OTP) attempts through certain API end… | |
CVE-2025-3556 | Low | 3.7 | 2025-04-14 | A vulnerability classified as problematic was found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this vulnerability is an unknown functionality… |
CVE-2025-3555 | Low | 3.7 | 2025-04-14 | A vulnerability classified as problematic has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected is an unknown function of the file /login.php… |
CVE-2025-3129 | Medium | 4.8 | 2025-04-02 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 bef… |
CVE-2025-0417 | | 2025-04-01 | Lack of protection against brute force attacks in Valmet DNA visualization in DNA Operate. The possibility to make an arbitrary number of login attempts withou… | |
CVE-2025-31676 | High | 8.8 | 2025-03-31 | Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3. |
CVE-2025-2911 | | 2025-03-28 | Unauthorised access to the call forwarding service system in MeetMe products in versions prior to 2024-09 allows an attacker to identify multiple users and per… | |
CVE-2025-1496 | Medium | 6.5 | 2025-03-20 | Improper Restriction of Excessive Authentication Attempts vulnerability in BG-TEK Coslat Hotspot allows Password Brute Forcing, Authentication Abuse. This iss… |
CVE-2024-12039 | High | 8.1 | 2025-03-20 | langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess attempts for password reset. This allows… |
CVE-2024-42176 | Low | 2.6 | 2025-03-19 | HCL MyXalytics is affected by concurrent login vulnerability. A concurrent login vulnerability occurs when simultaneous active sessions are allowed for a singl… |
CVE-2025-25595 | Critical | 9.8 | 2025-03-18 | A lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack. |
CVE-2024-51476 | High | 7.5 | 2025-03-06 | IBM Concert Software 1.0.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. |
CVE-2025-1714 | | 2025-03-05 | Lack of Rate Limiting in Sign-up workflow in Perforce Gliffy prior to version 4.14.0-7 on Gliffy online allows attacker to enumerate valid user emails and pote… | |
CVE-2025-23368 | High | 8.1 | 2025-03-04 | A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within… |
CVE-2025-1629 | Low | 3.5 | 2025-02-24 | A vulnerability was found in Excitel Broadband Private my Excitel App 3.13.0 on Android. It has been classified as problematic. Affected is an unknown function… |
CVE-2025-24806 | | 2025-02-19 | Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web port… | |
CVE-2025-22645 | Medium | 5.3 | 2025-02-18 | Improper Restriction of Excessive Authentication Attempts vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Password Brute Forcing.T… |
CVE-2024-57610 | High | 7.5 | 2025-02-06 | A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk… |
CVE-2024-23106 | High | 8.1 | 2025-01-14 | An improper restriction of excessive authentication attempts [CWE-307] in FortiClientEMS version 7.2.0 through 7.2.4 and before 7.0.10 allows an unauthenticate… |
CVE-2024-55008 | High | 7.5 | 2025-01-07 | JATOS 3.9.4 contains a denial-of-service (DoS) vulnerability in the authentication system, where an attacker can prevent legitimate users from accessing their… |
CVE-2024-53647 | Medium | 6.5 | 2024-12-31 | Trend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email verification requests… |
CVE-2024-8429 | Medium | 4.3 | 2024-12-17 | Improper Restriction of Excessive Authentication Attempts vulnerability in Digital Operation Services WiFiBurada allows Use of Known Domain Credentials. This… |
CVE-2024-38488 | Medium | 6.5 | 2024-12-13 | Dell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. An improper Restriction of Excessive Authentication vulnerability where a Network attack… |
CVE-2024-45404 | High | 8.1 | 2024-12-12 | OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attack… |
CVE-2024-46442 | Critical | 9.8 | 2024-12-10 | An issue in the BYD Dilink Headunit System v3.0 to v4.0 allows attackers to bypass authentication via a bruteforce attack. |
CVE-2024-9928 | Medium | 5.3 | 2024-11-26 | A vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts. If exploited, this could cause account takeover and unau… |
CVE-2024-49597 | High | 7.6 | 2024-11-26 | Dell Wyse Management Suite, versions WMS 4.4 and prior, contain an Improper Restriction of Excessive Authentication Attempts vulnerability. A high privileged a… |
CVE-2024-5716 | Critical | 9.8 | 2024-11-22 | Logsign Unified SecOps Platform Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installati… |
CVE-2024-0787 | Medium | 5.9 | 2024-11-15 | phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded… |
CVE-2024-9832 | Critical | 9.3 | 2024-11-14 | There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execu… |
CVE-2024-51720 | Medium | 4.8 | 2024-11-12 | An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attac… |
CVE-2024-11126 | Low | 3.1 | 2024-11-12 | A vulnerability was found in Digistar AG-30 Plus 2.6b. It has been classified as problematic. Affected is an unknown function of the component Login Page. The… |
CVE-2024-47592 | Medium | 5.3 | 2024-11-12 | SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs. This has an impac… |
CVE-2024-51558 | Critical | 9.8 | 2024-11-04 | This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker co… |
CVE-2024-48143 | Critical | 9.1 | 2024-10-24 | A lack of rate limiting in the OTP validation component of Digitory Multi Channel Integrated POS v1.0 allows attackers to gain access to the ordering system an… |
CVE-2024-7292 | High | 7.5 | 2024-10-09 | In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a credential stuffing attack is possible through improper restriction of excessive… |
CVE-2024-47656 | Critical | 9.8 | 2024-10-04 | This vulnerability exists in Shilpi Client Dashboard due to missing restrictions for incorrect login attempts on its API based login. A remote attacker could e… |
CVE-2024-41276 | Critical | 9.8 | 2024-10-01 | A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanism. The application requires users to inp… |
CVE-2024-47088 | Critical | 9.8 | 2024-09-19 | This vulnerability exists in Apex Softcell LD Geo due to missing restrictions for excessive failed authentication attempts on its API based login. A remote att… |
CVE-2024-45523 | Critical | 9.1 | 2024-09-18 | An issue was discovered in Bravura Security Fabric versions 12.3.x before 12.3.5.32784, 12.4.x before 12.4.3.35110, 12.5.x before 12.5.2.35950, 12.6.x before 1… |
CVE-2024-5682 | Medium | 6.5 | 2024-09-18 | Improper Restriction of Excessive Authentication Attempts vulnerability in Yordam Information Technology Yordam Library Automation System allows Interface Mani… |
CVE-2024-45790 | Critical | 9.8 | 2024-09-11 | This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing restrictions for excessive failed authentication attempts on its API based login. A r… |
CVE-2024-45327 | High | 7.5 | 2024-09-11 | An improper authorization vulnerability [CWE-285] in FortiSOAR version 7.4.0 through 7.4.3, 7.3.0 through 7.3.2, 7.2.0 through 7.2.2, 7.0.0 through 7.0.3 chang… |
CVE-2024-32771 | Low | 2.6 | 2024-09-06 | An improper restriction of excessive authentication attempts vulnerability has been reported to affect several QNAP operating system versions. If exploited, th… |
CVE-2024-45589 | Medium | 5.9 | 2024-09-05 | RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote attacker to cause a d… |
CVE-2024-8462 | Low | 3.7 | 2024-09-05 | A vulnerability was found in Windmill 1.380.0. It has been classified as problematic. Affected is an unknown function of the file backend/windmill-api/src/user… |
CVE-2021-22530 | High | 8.2 | 2024-08-28 | A vulnerability identified in NetIQ Advance Authentication that doesn't enforce account lockout when brute force attack is performed on API based login. This i… |
CVE-2024-43042 | Critical | 9.8 | 2024-08-16 | Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack. |
CVE-2024-42466 | Critical | 9.8 | 2024-08-16 | Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue a… |
CVE-2024-42465 | Critical | 9.8 | 2024-08-16 | Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue a… |
CVE-2024-39398 | High | 7.4 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnera… |
CVE-2024-41904 | High | 7.5 | 2024-08-13 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application do not properly enforce rest… |
CVE-2024-41682 | Medium | 5.3 | 2024-08-13 | A vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce restriction of excessive… |
CVE-2024-39225 | Critical | 9.8 | 2024-08-06 | GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E75… |
CVE-2024-38888 | Medium | 6.8 | 2024-08-02 | An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker to perform a Password… |
CVE-2024-38176 | High | 8.1 | 2024-07-23 | An improper restriction of excessive authentication attempts in GroupMe allows a unauthenticated attacker to elevate privileges over a network. |
CVE-2024-39917 | High | 7.2 | 2024-07-12 | xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The n… |
CVE-2024-39874 | High | 7.5 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly implement brute force… |
CVE-2024-39873 | High | 7.5 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly implement brute force… |
CVE-2024-25031 | Medium | 6.5 | 2024-06-28 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 uses an inadequate account lockout setting that could allow an attacker on the network to brute f… |
CVE-2024-5862 | High | 7.5 | 2024-06-24 | Improper Restriction of Excessive Authentication Attempts vulnerability in Mia Technology Inc. Mia-Med Health Aplication allows Interface Manipulation. This i… |
CVE-2024-28022 | Medium | 6.5 | 2024-06-11 | A vulnerability exists in the UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of authentication attempts usin… |
CVE-2024-35747 | Medium | 5.3 | 2024-06-10 | Improper Restriction of Excessive Authentication Attempts vulnerability in wpdevart Contact Form Builder, Contact Widget allows Functionality Bypass.This issue… |
CVE-2024-28833 | Medium | 5.9 | 2024-06-10 | Improper restriction of excessive authentication attempts with two factor authentication methods in Checkmk 2.3 before 2.3.0p6 facilitates brute-forcing of sec… |
CVE-2024-3102 | Medium | 5.3 | 2024-06-06 | A JSON Injection vulnerability exists in the `mintplex-labs/anything-llm` application, specifically within the username parameter during the login process at t… |
CVE-2023-48745 | Medium | 5.3 | 2024-06-04 | Improper Restriction of Excessive Authentication Attempts vulnerability in WebFactory Ltd Captcha Code allows Functionality Bypass.This issue affects Captcha C… |
CVE-2023-48318 | Medium | 5.3 | 2024-06-04 | Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Contact Form Email allows Functionality Bypass.This issue affects Contact… |
CVE-2023-48290 | Medium | 5.3 | 2024-06-04 | Improper Restriction of Excessive Authentication Attempts vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Functionality Bypass.This issue a… |
CVE-2023-48276 | Medium | 5.3 | 2024-06-04 | Improper Restriction of Excessive Authentication Attempts vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Functionality Bypass.This issue affects… |
CVE-2023-45009 | Medium | 5.3 | 2024-06-04 | Improper Restriction of Excessive Authentication Attempts vulnerability in Forge12 Interactive GmbH Captcha/Honeypot for Contact Form 7 allows Functionality By… |
CVE-2023-44235 | Medium | 5.3 | 2024-06-04 | Improper Restriction of Excessive Authentication Attempts vulnerability in Devnath verma WP Captcha allows Functionality Bypass.This issue affects WP Captcha… |
CVE-2023-34001 | Medium | 5.3 | 2024-06-04 | Improper Restriction of Excessive Authentication Attempts vulnerability in WPPlugins – WordPress Security Plugins Hide My WP Ghost allows Functionality Bypass… |
CVE-2023-23730 | Medium | 5.3 | 2024-06-03 | Improper Restriction of Excessive Authentication Attempts vulnerability in Brainstorm Force Spectra allows Functionality Bypass.This issue affects Spectra: fro… |
CVE-2024-32774 | Medium | 4.3 | 2024-05-17 | Improper Restriction of Excessive Authentication Attempts vulnerability in Metagauss ProfileGrid allows Removing Important Client Functionality.This issue affe… |
CVE-2024-32720 | Medium | 5.3 | 2024-05-17 | Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Appointment Hour Booking allows Removing Important Client Functionality.T… |
CVE-2024-3461 | Medium | 6.2 | 2024-05-14 | KioWare for Windows (versions all through 8.35) allows to brute force the PIN number, which protects the application from being closed, as there are no mechani… |
CVE-2024-32868 | Medium | 6.5 | 2024-04-26 | ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already give… |
CVE-2024-32676 | Medium | 5.3 | 2024-04-25 | Improper Restriction of Excessive Authentication Attempts vulnerability in LoginPress LoginPress Pro allows Removing Important Client Functionality.This issue… |
CVE-2024-28825 | Medium | 5.9 | 2024-04-24 | Improper restriction of excessive authentication attempts on some authentication methods in Checkmk before 2.3.0b5 (beta), 2.2.0p26, 2.1.0p43, and in Checkmk 2… |
CVE-2024-30390 | Medium | 5.3 | 2024-04-12 | An Improper Restriction of Excessive Authentication Attempts vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attack… |
CVE-2024-3202 | Low | 3.7 | 2024-04-02 | A vulnerability, which was classified as problematic, has been found in codelyfe Stupid Simple CMS 1.2.4. This issue affects some unknown processing of the com… |
CVE-2024-21662 | High | 7.5 | 2024-03-18 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the r… |
CVE-2024-21652 | Critical | 9.8 | 2024-03-18 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a chain of vulne… |
CVE-2024-2051 | Critical | 9.8 | 2024-03-18 | CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover and unauthorized access to the syste… |
CVE-2024-24767 | Critical | 9.1 | 2024-03-06 | CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against pa… |
CVE-2024-24721 | Medium | 6.5 | 2024-02-27 | An issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack through which an attacker… |
CVE-2024-1104 | High | 7.5 | 2024-02-22 | An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users. |
CVE-2024-1345 | Medium | 6.8 | 2024-02-19 | Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to perform a brute force attack and easily di… |
CVE-2024-21500 | Medium | 4.8 | 2024-02-17 | All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive Authentication Attempts via the two-factor a… |
CVE-2024-22425 | Medium | 6.5 | 2024-02-16 | Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability. An unauthenticated remote attacker could potentia… |
CVE-2023-45191 | High | 7.5 | 2024-02-09 | IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 uses an inadequate account lockout setting that could allow a remote attacker to brute force account cre… |