Account takeover via unrestricted credential guessing

Improper login throttling in 8CMS LJCMS 1.11 allows remote attackers to hijack user accounts through repeated credential guesses. The guestbook login endpoint accepts repeated username and password attempts without a verification code and returns distinct errors for nonexistent accounts and incorrect passwords. Network access to the login form is sufficient to enumerate valid usernames and brute-force their passwords, exposing only accounts whose credentials can be guessed.