Improper Control of Interaction Frequency
CWE-799
The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
We track 20 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1.
Latest Improper Control of Interaction Frequency vulnerabilities
- 7.1 High severity
wazuh: Improper Control of Interaction Frequency
Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.6.0 and above, prior to 4.14.5, a logic error in CheckRateLimitsMiddleware.dispatch() causes the /events endpoint rate check to unconditionally overwrit
- 7.1 High severity
Pizzy Library: Improper Control of Interaction Frequency
Improper Control of Interaction Frequency vulnerability in MIA Technology Inc. Pizzy Library allows Flooding. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250.
- 8.1 High severity
PDKS: Improper Control of Interaction Frequency
Improper Control of Interaction Frequency vulnerability in MeWare Software Development Inc. PDKS allows Flooding. This issue affects PDKS: from V16.20200313 before VMYR_3.5.2025117.
- 7.5 High severity
OpenClaw: Improper Control of Interaction Frequency
OpenClaw 2026.2.26 before 2026.3.31 enforces pending pairing-request caps per channel file instead of per account, allowing attackers to exhaust the shared pending window. Remote attackers can submit pairing requests from other accounts to block new pairing ch
- 8.8 High severity
runtipi: Improper Restriction of Excessive Authentication Attempts
Runtipi is a personal homeserver orchestrator. Prior to 4.8.1, The Runtipi /api/auth/verify-totp endpoint does not enforce any rate limiting, attempt counting, or account lockout mechanism. An attacker who has obtained a user's valid credentials (via phishing,
- 7.5 High severity
parse-server: Improper Control of Interaction Frequency
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior o 9.5.2-alpha.10 and 8.6.23, Parse Server's rate limiting middleware is applied at the Express middleware layer, but the batch request endpoint (/batc
- 8.1 High severity
FortiWeb: Improper Control of Interaction Frequency
An Improper Control of Interaction Frequency vulnerability [CWE-799] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow a r
- 8.1 High severity
SwiftBuy: Improper Restriction of Excessive Authentication Attempts
A security flaw has been discovered in Tasin1025 SwiftBuy up to 0f5011372e8d1d7edfd642d57d721c9fadc54ec7. Affected by this vulnerability is an unknown functionality of the file /login.php. Performing a manipulation results in improper restriction of excessive
- 9.8 Critical severity
Signinghub: Improper Control of Interaction Frequency
In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating reset password requests.
- 8.1 High severity
Community Edition: Improper Restriction of Excessive Authentication Attempts
A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1. This vulnerability affects unknown code of the file /login.jsp of the component Admin Login Page. Such manipulation leads to improper restriction of excessive authentication attempts.
- 7.5 High severity
fides: Improper Control of Interaction Frequency
Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Webserver API's built-in IP-based rate limiting is ineffective in environments with CDNs, proxies or load balancers. The system incorrectly applies rate limits based on di
- 9.1 Critical severity
mblog: Improper Restriction of Excessive Authentication Attempts
A vulnerability was found in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /settings/password. The manipulation leads to improper restriction of excessive authentication attempts. The attack may be initiated remotely. The comp
- 8.1 High severity
eCommerce-website-in-PHP: Improper Restriction of Excessive Authentication Attempts
A vulnerability classified as problematic was found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this vulnerability is an unknown functionality of the file /admin/login.php. The manipulation leads to improper restriction of excessive authenticat
- 8.1 High severity
eCommerce-website-in-PHP: Improper Restriction of Excessive Authentication Attempts
A vulnerability classified as problematic has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected is an unknown function of the file /login.php. The manipulation leads to improper restriction of excessive authentication attempts. It is possible
- 8.2 High severity
CAP back office application: Improper Control of Interaction Frequency
This vulnerability exists in the CAP back office application due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint whic
- 7.5 High severity
Client Dashboard: Improper Control of Interaction Frequency
This vulnerability exists in Shilpi Client Dashboard due to lack of rate limiting and Captcha protection for OTP requests in certain API endpoint. An unauthenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulne
- 7.5 High severity
Clibo Manager: Improper Control of Interaction Frequency
Rate limit vulnerability in Clibo Manager v1.1.9.2 that could allow an attacker to send a large number of emails to the victim in a short time, affecting availability and leading to a denial of service (DoS).
- 7.5 High severity
Mutual Fund Distribution Product (aiM-Star): Improper Control of Interaction Frequency
This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoints
- 8.8 High severity
Journyx (jtime): Use of Hard-coded Credentials
Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.
- 9.8 Critical severity
WP-PostRatings: Authentication Bypass by Spoofing
Improper Control of Interaction Frequency vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Functionality Misuse.This issue affects WP-PostRatings: from n/a through 1.91.