Dashboard / CVE-2026-122049

CVE-2026-122049

LOW
INFO Priority: 0.01 BB Relevance: 66/100
Published: 2026-11-05 Modified: 2026-11-05 First seen: 2026-11-04 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
S: X
AT: None
VC: Low
VI: None
VA: None

Description

A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used.

Weakness Classification (2)

Affected Software (2)

VendorProductVersion
Campcodes Bitcoin Wallet System 1.0
Campcodes Bitcoin Wallet System 1.0

References & Advisories (6)

https://vuldb.com/vuln/431126
vdb-entry technical-description
https://vuldb.com/submit/1025182
third-party-advisory
https://vuldb.com/vuln/431126/cti
signature permissions-required

Bug Bounty Relevance

66 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

2.9 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.40%
Raw Score 0.004020
Percentile 35.0%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00402
2026-11-13
0.00402
2026-11-12
0.00402
2026-11-10
0.00402
2026-11-09
0.00402
2026-11-08
0.00402
2026-11-07
0.00402
2026-11-06
0.00402
2026-11-05
0.00402

Intelligence Sources

mitre ref →
nvd ref →

External Links