# CWE-799.

Every Advisory and CVE whose sources give the weakness CWE-799, newest first.

## Records, newest first (an older page)

- [Komga Vulnerable to Arbitrary Code Execution via Crafted EPUB File](https://agentprime.io/advisories/CVE-2025-52880.md)
  `CVE-2025-52880` · CVE record: gotson komga · CVSS 4.2 Medium · Not analysed yet · Published 24 Jun 2025 · Tags: CWE-799
- [letmein connection limiter allows an arbitrary amount of simultaneous connections](https://agentprime.io/advisories/GHSA-jpv7-p47h-f43j.md)
  `GHSA-jpv7-p47h-f43j`, `CVE-2025-52570` · crates.io `letmeind` and 1 more: affected `<10.2.1`, fixed in `10.2.1` · CVSS 1.7 Low · Not analysed yet · Published 23 Jun 2025 · Tags: Denial of service, CWE-799
- [Tenda TDSEE App Password Reset Confirmation Code ConfirmSmsCode excessive authentication](https://agentprime.io/advisories/CVE-2025-5864.md)
  `CVE-2025-5864` · CVE record: Tenda TDSEE App · CVSS 6.3 Medium · Not analysed yet · Published 9 Jun 2025 · Tags: Authentication bypass, CWE-799
- [Improper Control of Interaction Frequency](https://agentprime.io/advisories/CVE-2025-48016.md)
  `CVE-2025-48016` · CVE record: Schweitzer Engineering Laboratories SEL-5056 Software-Defined Network Flow Controller · CVSS 4.3 Medium · Not analysed yet · Published 20 May 2025 · Tags: CWE-799
- [ScriptAndTools eCommerce-website-in-PHP login.php excessive authentication](https://agentprime.io/advisories/CVE-2025-3556.md)
  `CVE-2025-3556` · CVE record: ScriptAndTools eCommerce-website-in-PHP · CVSS 6.3 Medium · Not analysed yet · Published 14 Apr 2025 · Tags: Authentication bypass, CWE-799
- [ScriptAndTools eCommerce-website-in-PHP login.php excessive authentication](https://agentprime.io/advisories/CVE-2025-3555.md)
  `CVE-2025-3555` · CVE record: ScriptAndTools eCommerce-website-in-PHP · CVSS 6.3 Medium · Not analysed yet · Published 14 Apr 2025 · Tags: Authentication bypass, CWE-799
- [Shopware default newsletter opt-in settings allow for mass sign-up abuse](https://agentprime.io/advisories/GHSA-4h9w-7vfp-px8m.md)
  `GHSA-4h9w-7vfp-px8m`, `CVE-2025-32378`, `PKSA-7zw7-y79b-kv9s`, `PKSA-8vfm-96b7-t9nt` · Packagist `shopware/core` and 1 more: affected `<6.5.8.17 || >=6.6.0.0-rc1, <6.6.10.3 || >=6.7.0.0-rc1, <6.7.0.0-rc2`, fixed in `6.5.8.17`, `6.6.10.3`, `6.7.0.0-rc2` · CVSS 6.9 Medium · Not analysed yet · Published 9 Apr 2025 · Tags: CWE-799, CWE-1188
- [No Rate Limiting Vulnerability in CAP back office application](https://agentprime.io/advisories/CVE-2025-29998.md)
  `CVE-2025-29998` · CVE record: Rising Technosoft CAP back office application · CVSS 8.2 High · Not analysed yet · Published 13 Mar 2025 · Tags: CWE-799
- [Missing rate limit in MaysWind ezBookkeeping in github.com/mayswind/ezbookkeeping](https://agentprime.io/advisories/GHSA-772m-773g-qmhc.md)
  `GHSA-772m-773g-qmhc`, `CVE-2024-57603`, `GO-2025-3466` · Go `github.com/mayswind/ezbookkeeping`: affected `*`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: CWE-799
- [Excitel Broadband Private my Excitel App One-Time Password excessive authentication](https://agentprime.io/advisories/CVE-2025-1629.md)
  `CVE-2025-1629` · CVE record: Excitel Broadband Private my Excitel App · CVSS 5.1 Medium · Not analysed yet · Published 24 Feb 2025 · Tags: Authentication bypass, CWE-799
- [No Rate Limiting Vulnerability in RupeeWeb trading platform](https://agentprime.io/advisories/CVE-2025-26524.md)
  `CVE-2025-26524` · CVE record: Rupeeseed Technology Ventures RupeeWeb · CVSS 5.1 Medium · Not analysed yet · Published 14 Feb 2025 · Tags: CWE-799
- [Drupal Open Social allows Functionality Misuse](https://agentprime.io/advisories/GHSA-63wg-87qv-rw4r.md)
  `GHSA-63wg-87qv-rw4r`, `CVE-2024-13274`, `PKSA-w8d8-76fz-cbmj` · Packagist `goalgorilla/open_social`: affected `<12.3.8 || >=12.4.0, <12.4.5 || >=13.0.0-alpha1, <13.0.0-alpha11`, fixed in `12.3.8`, `12.4.5`, `13.0.0-alpha11` · CVSS 5.3 Medium · Not analysed yet · Published 9 Jan 2025 · Tags: CWE-799
- [Protection Mechanism Failure in Digital Operation Services' WiFiBurada](https://agentprime.io/advisories/CVE-2024-8475.md)
  `CVE-2024-8475` · CVE record: Digital Operation Services WiFiBurada · CVSS 6.5 Medium · Not analysed yet · Published 17 Dec 2024 · Tags: CWE-302, CWE-799
- [Digistar AG-30 Plus Login Page excessive authentication](https://agentprime.io/advisories/CVE-2024-11126.md)
  `CVE-2024-11126` · CVE record: Digistar AG-30 Plus · CVSS 2.3 Low · Not analysed yet · Published 12 Nov 2024 · Tags: Authentication bypass, CWE-799
- [No Rate Limiting Vulnerability in Wave 2.0](https://agentprime.io/advisories/CVE-2024-51557.md)
  `CVE-2024-51557` · CVE record: Brokerage Technology Solutions Wave 2.0 · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2024 · Tags: CWE-799
- [The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the 2FA PIN via the plugins/servlet/twofactor/public/pinvalidat…](https://agentprime.io/advisories/CVE-2024-48942.md)
  `CVE-2024-48942` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2024 · Tags: CWE-799
- [No Rate Limiting vulnerability](https://agentprime.io/advisories/CVE-2024-47654.md)
  `CVE-2024-47654` · CVE record: Shilpi Computers Client Dashboard · CVSS 7.1 High · Not analysed yet · Published 4 Oct 2024 · Tags: CWE-799
- [Rate limit vulnerability in Clibo Manager](https://agentprime.io/advisories/CVE-2024-9199.md)
  `CVE-2024-9199` · CVE record: Clibo Manager Clibo Manager · CVSS 5.8 Medium · Not analysed yet · Published 26 Sept 2024 · Tags: CWE-799
- [No Rate Limiting Vulnerability](https://agentprime.io/advisories/CVE-2024-45788.md)
  `CVE-2024-45788` · CVE record: Reedos Software Solutions Mutual Fund Distribution Product (aiM-Star) · CVSS 8.7 High · Not analysed yet · Published 11 Sept 2024 · Tags: CWE-799
- [Journyx Unauthenticated Password Reset Bruteforce](https://agentprime.io/advisories/CVE-2024-6890.md)
  `CVE-2024-6890` · CVE record: Journyx Journyx (jtime) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Aug 2024 · Tags: Hard-coded credentials, CWE-334, CWE-799
- [Westermo L210-F2G Lynx Improper Control of Interaction Frequency](https://agentprime.io/advisories/CVE-2024-32943.md)
  `CVE-2024-32943` · CVE record: Westermo L210-F2G Lynx · CVSS 8.7 High · Not analysed yet · Published 20 Jun 2024 · Tags: CWE-799
- [Westermo L210-F2G Lynx Improper Control of Interaction Frequency](https://agentprime.io/advisories/CVE-2024-35246.md)
  `CVE-2024-35246` · CVE record: Westermo L210-F2G Lynx · CVSS 8.7 High · Not analysed yet · Published 20 Jun 2024 · Tags: CWE-799
- [CVE](https://agentprime.io/advisories/CVE-2024-0094.md)
  `CVE-2024-0094` · CVE record: nvidia vGPU software and Cloud Gaming · CVSS 5.5 Medium · Not analysed yet · Published 13 Jun 2024 · Tags: CWE-799
- [WordPress RegistrationMagic plugin <= 5.2.5.0 - Form Submission Limit Bypass vulnerability](https://agentprime.io/advisories/CVE-2023-51544.md)
  `CVE-2023-51544` · CVE record: Metagauss RegistrationMagic · CVSS 5.3 Medium · Not analysed yet · Published 4 Jun 2024 · Tags: CWE-799
- [WordPress Cartpauj Register Captcha plugin <= 1.0.02 - Captcha Bypass vulnerability](https://agentprime.io/advisories/CVE-2023-40673.md)
  `CVE-2023-40673` · CVE record: cartpauj Cartpauj Register Captcha · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2024 · Tags: CWE-799
- [WordPress WP-PostRatings plugin <= 1.91 - Rating limit Bypass vulnerability](https://agentprime.io/advisories/CVE-2023-40332.md)
  `CVE-2023-40332` · CVE record: Lester ‘GaMerZ’ Chan WP-PostRatings · CVSS 5.3 Medium · Not analysed yet · Published 4 Jun 2024 · Tags: CWE-799
- [WordPress Polls CP plugin <= 1.0.71 - Polls Limitation Bypass vulnerability](https://agentprime.io/advisories/CVE-2024-24873.md)
  `CVE-2024-24873` · CVE record: CodePeople CP Polls · CVSS 5.3 Medium · Not analysed yet · Published 17 May 2024 · Tags: CWE-799
- [WOWS Karma vulnerable to a post submission bounce/timing attack](https://agentprime.io/advisories/CVE-2024-34695.md)
  `CVE-2024-34695` · CVE record: SakuraIsayeki WOWS-Karma · CVSS 6.3 Medium · Not analysed yet · Published 10 May 2024 · Tags: CWE-799
- [IBM Aspera Faspex denial of service](https://agentprime.io/advisories/CVE-2023-27279.md)
  `CVE-2023-27279` · CVE record: IBM Aspera Faspex · CVSS 6.5 Medium · Not analysed yet · Published 19 Apr 2024 · Tags: CWE-799
- [Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2023-35621.md)
  `CVE-2023-35621` · CVE record: Microsoft Dynamics 365 for Finance and Operations · CVSS 7.5 High · Not analysed yet · Published 12 Dec 2023 · Tags: CWE-799
- [In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms](https://agentprime.io/advisories/CVE-2023-38068.md)
  `CVE-2023-38068` · CVE record: JetBrains YouTrack · CVSS 6.5 Medium · Not analysed yet · Published 12 Jul 2023 · Tags: CWE-799
- [Contec CONPROSYS HMI System (CHS) v3.5.2 Denial of Service](https://agentprime.io/advisories/CVE-2023-2758.md)
  `CVE-2023-2758` · CVE record: Contec CONPROSYS HMI System · CVSS 3.7 Low · Not analysed yet · Published 31 May 2023 · Tags: CWE-799
- [ASUS GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 - Improper Authentication](https://agentprime.io/advisories/CVE-2021-37910.md)
  `CVE-2021-37910` · CVE record: ASUS GT-AXE11000 and 4 more · CVSS 3.7 Low · Not analysed yet · Published 12 Nov 2021 · Tags: CWE-799
- [Rate-limits not working on instances without configured memory cache backend](https://agentprime.io/advisories/CVE-2021-41177.md)
  `CVE-2021-41177` · CVE record: nextcloud security-advisories · CVSS 8.1 High · Not analysed yet · Published 25 Oct 2021 · Tags: CWE-799
- [A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2).](https://agentprime.io/advisories/CVE-2021-37191.md)
  `CVE-2021-37191` · CVE record: Siemens SINEMA Remote Connect Server · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2021 · Tags: CWE-799
- [Lack of ratelimit on public share link mount endpoint](https://agentprime.io/advisories/CVE-2021-32741.md)
  `CVE-2021-32741` · CVE record: nextcloud security-advisories · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2021 · Tags: CWE-799
- [Lack of ratelimit on public DAV endpoint](https://agentprime.io/advisories/CVE-2021-32705.md)
  `CVE-2021-32705` · CVE record: nextcloud security-advisories · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2021 · Tags: CWE-799
- [Lack of ratelimit on shareinfo endpoint](https://agentprime.io/advisories/CVE-2021-32703.md)
  `CVE-2021-32703` · CVE record: nextcloud security-advisories · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2021 · Tags: CWE-799
- [Ratelimit not applied on OCS API responses](https://agentprime.io/advisories/CVE-2021-32678.md)
  `CVE-2021-32678` · CVE record: nextcloud security-advisories · CVSS 3.7 Low · Not analysed yet · Published 12 Jul 2021 · Tags: CWE-799
- [Improper rate limiting in Koel](https://agentprime.io/advisories/GHSA-r37h-j483-cjjm.md)
  `GHSA-r37h-j483-cjjm`, `CVE-2021-33563`, `PKSA-929f-gr4s-2fz1` · Packagist `phanan/koel`: affected `<5.1.4`, fixed in `5.1.4` · No CVSS score · Not analysed yet · Published 1 Jun 2021 · Tags: Weak cryptography or TLS, CWE-799
- [SonicWall SonicOS: A vulnerability in SonicOS allows a remote unauthenticated attacker to brute force…](https://agentprime.io/advisories/CVE-2020-5141.md)
  `CVE-2020-5141` · CVE record: SonicWall SonicOS · No CVSS score · Not analysed yet · Published 12 Oct 2020 · Tags: CWE-799
- [Improper Control of Interaction Frequency in Apache syncope-core](https://agentprime.io/advisories/GHSA-9h9c-f287-c6vp.md)
  `GHSA-9h9c-f287-c6vp`, `CVE-2018-17184` · Maven `org.apache.syncope:syncope-core`: affected `<2.0.11 || >=2.1.0, <2.1.2`, fixed in `2.0.11`, `2.1.2` · CVSS 5.4 Medium · Not analysed yet · Published 6 Nov 2018 · Tags: CWE-799
- [A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data](https://agentprime.io/advisories/CVE-2016-6543.md)
  `CVE-2016-6543` · CVE record: iTrack Easy · No CVSS score · Not analysed yet · Published 13 Jul 2018 · Tags: CWE-799

Newest: <https://agentprime.io/advisories/tag/cwe-799.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-799&cursor=WyIyMDI1LTA3LTExVDE3OjAwOjQ0LjIyMTAwMFoiLCJDVkUtMjAyNC00NzA2NSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-799/?cursor=WyIyMDI1LTA3LTExVDE3OjAwOjQ0LjIyMTAwMFoiLCJDVkUtMjAyNC00NzA2NSJd>. Everything for agents: <https://agentprime.io/llms.txt>.