EUVD-2026-94448

A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during th...

CVE-2026-20328 Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability

A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during th...

CVE-2026-20328

A vulnerability in the web-based management interface of Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem ) allows an unauthenticated, remote attacker to gain unauthorized access. The root cause is improper checks during the password reset process. By sending a malicious reque...

CVE-2026-20328 Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability

A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during th...

CVE-2025-63314

CVE-2025-63314 - Gestion inappropriée du jeton de réinitialisation de mot de passe dans Acora CMS Découvert par Joby Y Daniel de Crowe India 📌 Présentation cm3 Acora CMS version 10.7.1 de DDSN Interactive contient une vulnérabilité de sécurité dans sa fonctionnalité de réinitialisation de mot de...

CVE-2021-22911

Обновлённый эксплойт для CVE-2021-22911 Rocket.Chat 3.12.1 - NoSQL-инъекция к RCE без аутентификации Авторство: https://www.exploit-db.com/exploits/50108 Установка Создайте виртуальное окружение Python и установите зависимости $ python -m venv venv $ source venv/bin/activate $ pip install request...

cve-2023-44487

CVE-2023-44487 HTTP/2 Быстрый сброс В этом репозитории есть несколько примеров, которые не были полностью протестированы для анализа воздействия, но я просто хотел продемонстрировать концепцию этой атаки starting many streams and immediately sending RSTSTREAM frame to avoid reaching...

CVE-2019-12889

CVE-2019-12889 Résumé Il existe une élévation de privilèges non authentifiée dans SailPoint Desktop Password Reset 7.2. Un utilisateur disposant d'un accès local uniquement à l'écran de connexion Windows peut élever ses privilèges à NT AUTHORITY\System. Un attaquant aurait besoin d'un accès local...

PT-2026-107587

Name of the Vulnerable Software and Affected Versions Cisco License On-Prem affected versions not specified Description An issue in the web-based management interface of Cisco License On-Prem, previously known as Cisco Smart Software Manager On-Prem, allows an unauthenticated remote attacker to...

CVE-2020-26061

CVE-2020-26061 ClickStudios Passwordstate - Contournement d'authentification du portail de réinitialisation de mot de passe Informations Fournisseur : ClickStudios Produit : Passwordstate Versions affectées : Avant 8.5 build 8501 Chercheur : Jason Juntunen alias @missing0x00...

CVE-2018-5354

CVE-2018-5354 Client de réinitialisation de mot de passe ANIXIS - Élévation de privilèges/RCE Informations Fournisseur : ANIXIS Produit : Client de réinitialisation de mot de passe ANIXIS Versions concernées : Antérieures à la version 3.22 Chercheur : Jason Juntunen alias @missing0x00...

CVE-2026-105853

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot...

CVE-2026-12416-CVE-2026-12417

CVE-2026-12416-CVE-2026-12417 Prise de contrôle de compte non authentifiée via une validation faible de réinitialisation de mot de passe utilisant le paramètre 'resetuserid' | Escalade de privilèges non authentifiée via une validation faible de réinitialisation de mot de passe utilisant...

Payload: Token refresh and password reset responses may expose restricted user fields

Impact Token refresh and password reset responses could return fields that the requesting user did not have access to. You are affected if: - An authentication collection contains hidden or read-restricted fields. Patches Authentication responses now apply field access and hidden-field filtering...

GHSA-XGV3-CRQ2-6F69 Payload: Token refresh and password reset responses may expose restricted user fields

Impact Token refresh and password reset responses could return fields that the requesting user did not have access to. You are affected if: - An authentication collection contains hidden or read-restricted fields. Patches Authentication responses now apply field access and hidden-field filtering...

NPM: Payload: Token refresh and password reset responses may expose restricted user fields

NPM: Payload: Token refresh and password reset responses may expose restricted user fields vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

CVE-2026-105853 Payload: Token refresh and password reset responses may expose restricted user fields

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot...

EUVD-2026-93497

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot...

CVE-2026-105853

The Payload headless content management system is vulnerable to information disclosure in versions 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34 . The root cause is that token refresh and password reset responses can independently return hidden or read-restricted fields that the ...

CVE-2026-105853 Payload: Token refresh and password reset responses may expose restricted user fields

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot...