#WebSecurity

How inconsistent email normalization between the rate limiter and delivery logic allows unlimited OTP requests — a classic normalization-mismatch bug.

High-severity Firebase and Web3Forms API credential exposure in Nexulean Website through publicly accessible client-side resources. Fixed in v2.0.0.

Moderate-severity DOM-based cross-site scripting in IP Reputation Checker where insufficient sanitization of user-controlled input before DOM insertion allows arbitrary script execution in the victim's browser.

Moderate-severity JWT authentication bypass in OpenLearnX where insufficient signature verification could allow attackers to supply forged tokens and bypass identity validation.

Unauthenticated LFI in Bagisto allows arbitrary file read via path traversal without authentication. Disclosed via CERT-In and assigned CVE-2026-9506.