CWE-307 · Authentication
Improper Restriction of Excessive Authentication Attempts
695CVEs
0exploited
2with a public check
6likely (EPSS 10%+)
SortMost likely exploited
695 CVEs with CWE-307 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2020-15906CheckTiki Wiki CMS GroupWare - Authentication BypassTiki · Tiki · 2020-10-22 | – | 27% | 2020-10-22 |
| CVE-2026-62850CheckFreeScout < 1.8.225 - Unauthenticated Maintenance File Existence Oraclefreescout-help-desk · freescout · CVSS 5.3 · 2026-11-06 | 5.3 | 0.6% | 2026-11-06 |
| CVE-2019-17240bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers.Bludit · Bludit · CVSS 3.7 · 2019-10-06 | 3.7 | 41% | 2019-10-06 |
| CVE-2023-29301Adobe ColdFusion Improper Restriction of Excessive Authentication Attempts Security feature bypassAdobe · ColdFusion · CVSS 7.5 · 2023-07-12 | 7.5 | 35% | 2023-07-12 |
| CVE-2016-9361An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions…Moxa · Moxa NPort · CVSS 9.8 · 2017-02-13 | 9.8 | 20% | 2017-02-13 |
| CVE-2025-4094Digits < 8.4.6.1 - Auth Bypass via OTP BruteforcingUnitedover · DIGITS: WordPress Mobile Number Signup and Login · CVSS 9.8 · 2025-05-21 | 9.8 | 17% | 2025-05-21 |
| CVE-2024-39225GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1…Gl-Inet · Mt6000 Firmware · CVSS 9.8 · 2024-08-06 | 9.8 | 14% | 2024-08-06 |
| CVE-2021-36750ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across USB drives sold under…Zendesk · Enc Datavault · 2021-12-22 | – | 14% | 2021-12-22 |
| CVE-2023-27100Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to by…Netgate · Pfsense Plus · CVSS 9.8 · 2023-03-22 | 9.8 | 9.9% | 2023-03-22 |
| CVE-2001-1291The telnet server for 3Com hardware such as PS40 SuperStack II does not delay or disconnect remote attackers who provide an incorrect username or password, which makes it easier t…3com · Superstack Ii Ps Hub 40 Firmware · 2003-04-02 | – | 8.9% | 2003-04-02 |
| CVE-2001-1339Beck IPC GmbH IPC@CHIP telnet service does not delay or disconnect users from the service when bad passwords are entered, which makes it easier for remote attackers to conduct bru…Anybus · Ipc@chip Firmware · 2002-05-03 | – | 7.5% | 2002-05-03 |
| CVE-2017-7898An Improper Restriction of Excessive Authentication Attempts issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA,…Rockwellautomation · Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 · CVSS 9.8 · 2017-06-30 | 9.8 | 7.0% | 2017-06-30 |
| CVE-2021-41435A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX…Asus · Gt-Ax11000 Firmware · 2021-11-19 | – | 6.5% | 2021-11-19 |
| CVE-2020-27423Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailboxAnuko · Time Tracker · 2020-11-16 | – | 6.4% | 2020-11-16 |
| CVE-2019-17525The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks.Dlink · Dir-615 Firmware · 2020-04-21 | – | 5.8% | 2020-04-21 |
| CVE-2019-1126A security feature bypass vulnerability exists in Active Directory Federation Services (ADFS) which could allow an attacker to bypass the extranet lockout policy.To exploit this v…Microsoft · Windows Server · 2019-07-29 | – | 4.9% | 2019-07-29 |
| CVE-2014-5414Beckhoff Embedded PC Images and TwinCAT Components Improper Restriction of Excessive Authentication AttemptsBeckhoff · Embedded PC Images · CVSS 9.1 · 2016-10-05 | 9.1 | 4.8% | 2016-10-05 |
| CVE-2020-7995The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts.Dolibarr · Dolibarr Erp/crm · 2020-01-26 | – | 4.5% | 2020-01-26 |
| CVE-2020-35590LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header c…Limitloginattempts · Limit Login Attempts Reloaded · 2020-12-21 | – | 4.3% | 2020-12-21 |
| CVE-2021-27514EyesOfNetwork 5.3-10 uses an integer of between 8 and 10 digits for the session ID, which might be leveraged for brute-force authentication bypass (such as in CVE-2021-27513 explo…Eyesofnetwork · Eyesofnetwork · 2021-02-21 | – | 3.5% | 2021-02-21 |
| CVE-2022-30076ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 through s20000. There is no rate limiting.Entab · Erp · CVSS 5.3 · 2023-04-16 | 5.3 | 3.5% | 2023-04-16 |
| CVE-2025-67091An issue in GL Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. GL.Inet AX1800 Version 4.6.4 & 4.6.8 in the GL.iNet custom opkg wrapper script located at /usr/libexec/opk…Gl-Inet · Ax1800 Firmware · CVSS 6.5 · 2026-01-08 | 6.5 | 3.3% | 2026-01-08 |
| CVE-2016-9366An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions…Moxa · Moxa NPort · CVSS 9.8 · 2017-02-13 | 9.8 | 3.1% | 2017-02-13 |
| CVE-2021-3138In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms.Discourse · Discourse · 2021-01-14 | – | 3.1% | 2021-01-14 |
| CVE-1999-1324VAXstations running Open VMS 5.3 through 5.5-2 with VMS DECwindows or MOTIF do not properly disable access to user accounts that exceed the break-in limit threshold for failed log…Hp · Openvms Vax · 2002-03-09 | – | 3.1% | 2002-03-09 |
| CVE-2022-36413Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset on IDM applications.Zohocorp · Manageengine Adselfservice Plus · 2023-03-23 | – | 3.1% | 2023-03-23 |
| CVE-2018-1373IBM Security Guardium Big Data Intelligence (SonarG) 3.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Fo…IBM · Security Guardium Big Data Intelligence · CVSS 7.5 · 2018-03-02 | 7.5 | 3.0% | 2018-03-02 |
| CVE-2020-11650An issue was discovered in iXsystems FreeNAS (and TrueNAS) 11.2 before 11.2-u8 and 11.3 before 11.3-U1. It allows a denial of service. The login authentication component has no li…Ixsystems · Freenas Firmware · 2020-04-08 | – | 3.0% | 2020-04-08 |
| CVE-2018-5469An Improper Restriction of Excessive Authentication Attempts issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform…Belden · Hirschmann Automation and Control GmbH Classic Platform Switches · 2018-03-06 | – | 2.9% | 2018-03-06 |
| CVE-2013-1895The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests,…py-bcrypt · py-bcrypt · 2020-01-28 | – | 2.8% | 2020-01-28 |
| CVE-2020-28212A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could…Schneider-Electric · PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) · 2020-11-19 | – | 2.8% | 2020-11-19 |
| CVE-2019-6524Moxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to discover passwords via brute force attack.ICS-CERT · Moxa IKS, EDS · 2019-03-05 | – | 2.7% | 2019-03-05 |
| CVE-2020-13872Royal TS before 5 has a 0.0.0.0 listener, which makes it easier for attackers to bypass tunnel authentication via a brute-force approach.Royalapps · Royal Ts · 2020-06-09 | – | 2.7% | 2020-06-09 |
| CVE-2021-33190Bypass network access controlApache Software Foundation · Apache APISIX Dashboard · 2021-06-08 | – | 2.7% | 2021-06-08 |
| CVE-2021-38155OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to…Openstack · Keystone · 2021-08-06 | – | 2.5% | 2021-08-06 |
| CVE-2020-6852CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 has weak authentication of TELNET access, leading to root privileges without any password required.Cacagoo · Tv-288zd-2mp Firmware · 2020-04-02 | – | 2.4% | 2020-04-02 |
| CVE-2019-12941AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force attack or dictionary attack to gain access to the WiFi network, which provides roo…Autopi · Wi-Fi/nb Firmware · 2019-10-14 | – | 2.4% | 2019-10-14 |
| CVE-2013-4441The Phonemes mode in Pwgen 2.06 generates predictable passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.Pwgen · Pwgen · 2020-01-27 | – | 2.4% | 2020-01-27 |
| CVE-2020-4567IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 18…IBM · Security Key Lifecycle Manager · CVSS 8.6 · 2020-07-29 | 8.6 | 2.3% | 2020-07-29 |
| CVE-2023-36434Windows IIS Server Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 22H2 · CVSS 9.8 · 2023-10-10 | 9.8 | 2.3% | 2023-10-10 |
| CVE-2016-9124Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable to password-guessing attacks.…Revive-Adserver · Revive Adserver All versions before 3.2.3 · 2017-03-28 | – | 2.2% | 2017-03-28 |
| CVE-2019-4520IBM Security Directory Server 6.4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 165178.IBM · Security Directory Server · CVSS 7.5 · 2019-10-02 | 7.5 | 2.2% | 2019-10-02 |
| CVE-2020-8827As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimite…Argoproj · Argo Cd · 2020-04-08 | – | 2.2% | 2020-04-08 |
| CVE-2019-4310IBM Security Guardium Big Data Intelligence 4.0 (SonarG) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Fo…IBM · Security Guardium Big Data Intelligence · CVSS 7.5 · 2019-08-20 | 7.5 | 2.2% | 2019-08-20 |
| CVE-2002-0628The Telnet service for Polycom ViewStation before 7.2.4 does not restrict the number of failed login attempts, which makes it easier for remote attackers to guess usernames and pa…Polycom · Viewstation 128 · 2003-01-03 | – | 2.2% | 2003-01-03 |
| CVE-2018-1475IBM BigFix Platform 9.2 and 9.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 140756.IBM · BigFix Platform · 2018-04-27 | – | 2.2% | 2018-04-27 |
| CVE-2019-3746Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote user may exploit thi…Dell · Integrated Data Protection Appliance · CVSS 9.8 · 2019-09-27 | 9.8 | 2.1% | 2019-09-27 |
| CVE-2020-18698Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in the component 'app/api…Talelin · Lin-Cms-Flask · 2021-08-16 | – | 2.1% | 2021-08-16 |
| CVE-2026-44596Yamcs: No Rate Limiting on Authentication Endpointyamcs · yamcs · CVSS 6.5 · 2026-07-16 | 6.5 | 2.1% | 2026-07-16 |
| CVE-2022-29084Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication attempts in Unisphere GUI. A remote unauthenticated attacker ma…Dell · Unity · CVSS 8.1 · 2022-06-02 | 8.1 | 2.0% | 2022-06-02 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.