CVE-2026-71213criticalCWE-307

CVE-2026-71213: falha crítica em typemill

typemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar typemill

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 0.5%
Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
typemill · typemill
CVEs relacionadas — typemill

No mesmo produto, das mais perigosas para as menos.

CVE-2026-71518HIGHTypemill < 2.26.0 Authorization Bypass via Media File Download RouteEPSS 0.5%CVE-2026-53468MEDIUMTypemill has Stored HTML Attribute Injection in Metadata FieldsEPSS 0.4%CVE-2026-49133HIGHTypemill < 2.24.0 Path Traversal via ControllerApiImage::getPagemedia()EPSS 0.3%CVE-2026-24127MEDIUMTypemill has Reflected XSS via login error view templateEPSS 0.3%