Search
Find a vulnerability
Search criteria
2 vulnerabilities found for Bitcoin Wallet System by Campcodes
CVE-2026-122049 (GCVE-0-2026-122049)
Vulnerability from nvd – Published: 2026-11-04 23:15 – Updated: 2026-11-05 20:29 X_Freeware
VLAI
EPSS
VEX
Title
Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication
Summary
A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 20:29 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431126 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431126/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-122049 | third-party-advisory |
| https://vuldb.com/submit/1025182 | third-party-advisory |
| https://tracexlabs.com/releases/campcodes-bitcoin… | exploitpatch |
| https://www.campcodes.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Campcodes | Bitcoin Wallet System |
Affected:
1.0
cpe:2.3:a:campcodes:bitcoin_wallet_system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122049",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T20:29:13.706511Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T20:29:21.838Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:campcodes:bitcoin_wallet_system:*:*:*:*:*:*:*:*"
],
"product": "Bitcoin Wallet System",
"vendor": "Campcodes",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "SanthoshKumar (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack\u0027s complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-799",
"description": "Improper Control of Interaction Frequency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T23:15:11.070Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431126 | Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431126"
},
{
"name": "VDB-431126 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431126/cti"
},
{
"name": "CVE-2026-122049 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-122049"
},
{
"name": "Submit #1025182 | CampCodes CampCodes Bitcoin Wallet System n/a Authentication Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1025182"
},
{
"tags": [
"exploit",
"patch"
],
"url": "https://tracexlabs.com/releases/campcodes-bitcoin-wallet-reset-code-flaws.html"
},
{
"tags": [
"product"
],
"url": "https://www.campcodes.com/"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-04T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-04T17:03:56.000Z",
"value": "VulDB entry last update"
}
],
"title": "Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-122049",
"datePublished": "2026-11-04T23:15:11.070Z",
"dateReserved": "2026-11-04T15:58:50.626Z",
"dateUpdated": "2026-11-05T20:29:21.838Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122049 (GCVE-0-2026-122049)
Vulnerability from cvelistv5 – Published: 2026-11-04 23:15 – Updated: 2026-11-05 20:29 X_Freeware
VLAI
EPSS
VEX
Title
Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication
Summary
A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 20:29 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431126 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431126/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-122049 | third-party-advisory |
| https://vuldb.com/submit/1025182 | third-party-advisory |
| https://tracexlabs.com/releases/campcodes-bitcoin… | exploitpatch |
| https://www.campcodes.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Campcodes | Bitcoin Wallet System |
Affected:
1.0
cpe:2.3:a:campcodes:bitcoin_wallet_system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122049",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T20:29:13.706511Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T20:29:21.838Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:campcodes:bitcoin_wallet_system:*:*:*:*:*:*:*:*"
],
"product": "Bitcoin Wallet System",
"vendor": "Campcodes",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "SanthoshKumar (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack\u0027s complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-799",
"description": "Improper Control of Interaction Frequency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T23:15:11.070Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431126 | Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431126"
},
{
"name": "VDB-431126 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431126/cti"
},
{
"name": "CVE-2026-122049 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-122049"
},
{
"name": "Submit #1025182 | CampCodes CampCodes Bitcoin Wallet System n/a Authentication Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1025182"
},
{
"tags": [
"exploit",
"patch"
],
"url": "https://tracexlabs.com/releases/campcodes-bitcoin-wallet-reset-code-flaws.html"
},
{
"tags": [
"product"
],
"url": "https://www.campcodes.com/"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-04T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-04T17:03:56.000Z",
"value": "VulDB entry last update"
}
],
"title": "Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-122049",
"datePublished": "2026-11-04T23:15:11.070Z",
"dateReserved": "2026-11-04T15:58:50.626Z",
"dateUpdated": "2026-11-05T20:29:21.838Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}