Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-31283 — Documentation of CVE-2026-31283: an email bombing vulnerability in Totara LMS's forgot password API due to missing rate limiting, allowing unauthenticated remote attackers to flood victim email inboxes. | Kitploit
Tools/GitHubGitHub/saykino/cve-2026-31283
Vulnerability AnalysisWeb SecurityMisconfigurationLearning & EducationAPI SecurityEmail Security
GitHubsaykino/cve-2026-31283

CVE-2026-31283

Documentation of CVE-2026-31283: an email bombing vulnerability in Totara LMS's forgot password API due to missing rate limiting, allowing unauthenticated remote attackers to flood victim email inboxes.

View Repository
265 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-31283

Description

  • Forgot password can be used to luanch email bombing attack on a victim email.

CVSS 3 Score: 7.5 (High)

Attack Type

  • Remote (Unauthenticated)

Affected Versions

  • Versions before <= 19.1.5

Vendor of Product

  • Totara

Affected Product Code Base

  • Totara LMS

Affected Component

  • Forgot password API.

Mitigations

  • Implement rate-limit for the Forgot password API.

Vulnerability Details

  • The forgot password API does not implement ratelimiting for the target email address. which can be used for an Email Bombing attack.

Fixed versions

  • Versions after > 19.1.5

Discovered By:

  • Yazan Abu-Nadi
Download Tool