Reserved but Public CVEs

First seen Jul 14, 2026

First seen Jul 14, 2026

CVE-2026-47677 is an authentication bypass vulnerability in FacturaScripts affecting the two-factor authentication flow. The issue resides in the login endpoint handling two-factor validation, where the application accepts TOTP verification attempts without adequately binding the request to a successfully completed primary password-authentication step. As a result, an unauthenticated attacker who knows a target user's nick can directly submit repeated TOTP guesses against the two-factor validation action. The vulnerable flow also lacks sufficient request validation and pre-verification abuse controls, enabling brute-force attempts against 2FA codes. The weakness can lead to full compromise of accounts protected by two-factor authentication, including administrative accounts.

CVE-2026-47677First seen Jul 14, 2026

First seen Jul 10, 2026

First seen Jul 10, 2026

First seen Jul 9, 2026

First seen Jul 9, 2026

First seen Jul 9, 2026

First seen Jul 7, 2026

First seen Jul 2, 2026

First seen Jul 2, 2026

First seen Jul 2, 2026

First seen Jul 2, 2026

First seen Jul 2, 2026

CVE-2023-50756First seen Jun 27, 2026

First seen Jun 26, 2026

First seen Jun 26, 2026

First seen Jun 26, 2026

First seen Jun 26, 2026

First seen Jun 26, 2026

First seen Jun 26, 2026

First seen Jun 24, 2026

First seen Jun 18, 2026

First seen Jun 18, 2026

First seen Jun 18, 2026