CVE-2026-64822Medium· 5.3▾ TwilightPoC availabledjangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error m…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can submit arbitrary usernames or email addresses to the POST login/esqueceu/ endpoint and distinguish between existing and non-existing accounts based on observable discrepancies in the application's responses.
djangoSIGE <= 1.10djangoSIGE <= a6fe7e8e3a7d52ba0a25305df4e5e7e0cd5f5792Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-64821Medium· 4.3djangoSIGE 1.10 CSRF via GET-based Order Cancellation Views
CVE-2026-56316Medium· 5.3Cap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/*
CVE-2026-56319Medium· 4.3Capgo - App Existence Oracle via GET /statistics/app/:app_id
CVE-2023-6240Medium· 6.5Kernel: marvin vulnerability side-channel leakage in the rsa decryption operation
CVE-2026-114064Medium· 5.5Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint
CVE-2026-112995High· 8.8Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page