What is GHSA-9qfp-w4r3-78pg?

GHSA-9qfp-w4r3-78pg is a security advisory published by GitHub Security Advisories with Medium severity. WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie...

Which CVE IDs does GHSA-9qfp-w4r3-78pg cover?

GHSA-9qfp-w4r3-78pg covers the following CVE IDs: CVE-2026-112205. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-9qfp-w4r3-78pgMedium

WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie...

Vendor

GitHub Security Advisories

Published

November 9, 2026

Last Modified

November 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-112205 →

📋 Description

WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies, allowing an unauthenticated attacker to perform an unlimited number of login attempts.

This issue has been fixed in version 2.5.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-112205
https://cert.pl/posts/2026/11/CVE-2026-110468
https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175
https://github.com/advisories/GHSA-9qfp-w4r3-78pg