| عنوان | atjiu https://github.com/atjiu/pybbs <=6.0.0 Enumerate registered emails |
|---|
| الوصف | In the latest v6.0.0 version, the endpoint /api/settings/sendEmailCode has a logic issue. The error message indicates that the email has already been registered, and there are no security measures such as rate limiting or CSRF protection. This allows attackers to exploit this error message to brute-force registered users' emails, thereby leaking the email addresses of registered users. |
|---|
| المصدر | ⚠️ https://github.com/atjiu/pybbs/issues/202 |
|---|
| المستخدم | ZAST.AI (UID 87884) |
|---|
| ارسال | 25/07/2025 03:33 AM (1 سنة منذ) |
|---|
| الاعتدال | 04/08/2025 03:05 PM (10 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 318677 [atjiu pybbs حتى 6.0.0 Registered Email SettingsApiController.java sendEmailCode email الكشف عن المعلومات] |
|---|
| النقاط | 19 |
|---|