CVE-2025-47951

Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing. This issue has been patched in version 5.12.

• CWE-307

• https://github.com/WeblateOrg/weblate/commit/f806293451248c5d95e45b3b507e9d158bc4f384Patch
• https://github.com/WeblateOrg/weblate/pull/14918Issue Tracking
• https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.12.1Release Notes
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-57jg-m997-cx3qVendor Advisory
• https://hackerone.com/reports/3150564Permissions Required

Published

Jun 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-47946Symfony UX is an initiative and set of libraries to integrat…6.1
• CVE-2025-47947ModSecurity is an open source, cross platform web applicatio…7.5
• CVE-2025-47948Cocotais Bot is a QQ official robot framework based on qq-bo…7.2
• CVE-2025-47949samlify is a Node.js library for SAML single sign-on. A Sign…7.5
• CVE-2025-4795A vulnerability classified as critical has been found in gon…7.2
• CVE-2025-47950CoreDNS is a DNS server that chains plugins. In versions pri…7.5
• CVE-2025-47952Traefik (pronounced traffic) is an HTTP reverse proxy and lo…9.1
• CVE-2025-47953Use after free in Microsoft Office allows an unauthorized at…8.4
• CVE-2025-47954Improper neutralization of special elements used in an sql c…8.8
• CVE-2025-47955Improper privilege management in Windows Remote Access Conne…7.8
• CVE-2025-47956External control of file name or path in Windows Security Ap…5.5
• CVE-2025-47957Use after free in Microsoft Office Word allows an unauthoriz…8.4