Medium severity5.3NVD Advisory· Published Jun 26, 2018· Updated Jun 17, 2026

CVE-2018-1000549

Description

Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker could perform a brute force attack to obtain valid usernames and email addresses.. This attack appear to be exploitable via HTTP Request.

Affected products

Wekan/Wekaninferred2 versions
= 1.04.0+ 1 more
- (no CPE)range: = 1.04.0
- (no CPE)range: =1.04.0
Wekan Project/Wekan
cpe:2.3:a:wekan_project:wekan:1.04.0:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

shadow-vault.com/wekan.htmlnvdThird Party Advisory
raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2018/1000xxx/CVE-2018-1000549.jsonnvd
wekan.github.io/hall-of-fame/brutebleed/nvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000