Search

Find a vulnerability

Search criteria

    2 vulnerabilities by XauenDevs

    CVE-2026-126815 (GCVE-0-2026-126815)

    Vulnerability from cvelistv5 – Published: 2026-11-11 20:10 – Updated: 2026-11-11 20:10
    VLAI
    Title
    Pre-account hijacking via planted password
    Summary
    Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take over arbitrary accounts via a password planted on an unregistered email address that becomes valid upon the victim’s first passwordless login.
    Severity
    8.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
    CWE
    Assigner
    Grayback CNA
    References
    Impacted products
    Vendor Product Version
    XauenDevs Lagarto Chivato Affected: 0.1.0 , ≤ 0.4.2 (custom)
    Unaffected: 0.4.4
        cpe:2.3:a:xauendevs:lagarto_chivato:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Daniel Hidalgo (hidalg0d)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Lagarto Chivato",
          "vendor": "XauenDevs",
          "versions": [
            {
              "lessThanOrEqual": "0.4.2",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "0.4.4"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:xauendevs:lagarto_chivato:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.4.2",
                  "versionStartIncluding": "0.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:xauendevs:lagarto_chivato:0.4.4:*:*:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Daniel Hidalgo (hidalg0d)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take over arbitrary accounts via a password planted on an unregistered email address that becomes valid upon the victim\u2019s first passwordless login."
            }
          ],
          "value": "Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take over arbitrary accounts via a password planted on an unregistered email address that becomes valid upon the victim\u2019s first passwordless login."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T20:10:36.118Z",
        "orgId": "772f0079-75c2-41ca-913e-d9072716578b",
        "shortName": "Grayback"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.grayback.es/advisories"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.grayback.es/en/advisories"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Pre-account hijacking via planted password",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "772f0079-75c2-41ca-913e-d9072716578b",
    "assignerShortName": "Grayback",
    "cveId": "CVE-2026-126815",
    "datePublished": "2026-11-11T20:10:36.118Z",
    "dateReserved": "2026-11-11T20:02:32.040Z",
    "dateUpdated": "2026-11-11T20:10:36.118Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-126784 (GCVE-0-2026-126784)

    Vulnerability from cvelistv5 – Published: 2026-11-11 19:32 – Updated: 2026-11-11 19:32
    VLAI
    Title
    Uncontrolled resource consumption via post_notice
    Summary
    Missing rate limiting, per-account submission quota and geographic validation in the publicar_aviso RPC function in Lagarto Chivato 0.4.1 and earlier on Web allows remote authenticated attackers to flood the moderation queue via unlimited submission of notices with arbitrary coordinates.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
    CWE
    • CWE-770 - Allocation of resources without limits or throttling
    Assigner
    Grayback CNA
    References
    Impacted products
    Vendor Product Version
    XauenDevs Lagarto Chivato Affected: 0.1.0 , ≤ 0.4.1 (custom)
    Unaffected: 0.4.4
        cpe:2.3:a:xauendevs:lagarto_chivato:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    m1w34p0n
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Lagarto Chivato",
          "vendor": "XauenDevs",
          "versions": [
            {
              "lessThanOrEqual": "0.4.1",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "0.4.4"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:xauendevs:lagarto_chivato:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.4.1",
                  "versionStartIncluding": "0.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:xauendevs:lagarto_chivato:0.4.4:*:*:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "m1w34p0n"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing rate limiting, per-account submission quota and geographic validation in the \u003ccode\u003epublicar_aviso\u003c/code\u003e RPC function in Lagarto Chivato 0.4.1 and earlier on Web allows remote authenticated attackers to flood the moderation queue via unlimited submission of notices with arbitrary coordinates.\u0026nbsp;\u0026nbsp;"
            }
          ],
          "value": "Missing rate limiting, per-account submission quota and geographic validation in the publicar_aviso RPC function in Lagarto Chivato 0.4.1 and earlier on Web allows remote authenticated attackers to flood the moderation queue via unlimited submission of notices with arbitrary coordinates."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of resources without limits or throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T19:32:12.829Z",
        "orgId": "772f0079-75c2-41ca-913e-d9072716578b",
        "shortName": "Grayback"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.grayback.es/advisories"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.grayback.es/en/advisories"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Uncontrolled resource consumption via post_notice",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "772f0079-75c2-41ca-913e-d9072716578b",
    "assignerShortName": "Grayback",
    "cveId": "CVE-2026-126784",
    "datePublished": "2026-11-11T19:32:12.829Z",
    "dateReserved": "2026-11-11T19:14:35.966Z",
    "dateUpdated": "2026-11-11T19:32:12.829Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}