CVE-2025-26524

MediumCVSS 5.1/10Last modified Jun 17, 2026

Description

This vulnerability exists in RupeeWeb trading platform due to missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoints which could lead to the OTP bombing/ flooding on the targeted system.

Metrics

CVSS 4.0 5.1/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-799

Affected software

No affected versions have been published.

Timeline

Published: Feb 14, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-265258.6Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as tho CVE-2025-265266.5Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback ac CVE-2025-265275.3Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block.CVE-2025-265286.1The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.CVE-2025-265296.1Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.CVE-2025-26534.3A vulnerability was found in FoxCMS 1.25 and classified as problematic. Affected by this issue is some unknown functionality. The manipulati CVE-2025-265306.1The question bank filter required additional sanitizing to prevent a reflected XSS risk.CVE-2025-265315.3Insufficient capability checks made it possible to disable badges a user does not have permission to access.CVE-2025-265324.3Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.CVE-2025-265339.8An SQL injection risk was identified in the module list filter within course search.CVE-2025-265348.6Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in helloprint Helloprint helloprint allows Path CVE-2025-265359.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodeSolz Bitcoin / AltCoin Payment Gat