Skip to content
OpenAdvisories

Product · Alex Tselegidis

plainpad

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2026-73529

    Plainpad Missing Rate Limiting via POST /v1/sessions

    Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint due to dead code in App\Http\Kernel.php that is never inst…

    Alex Tselegidis plainpad