7 matches found
CVE-2026-45298
creationtimestamp| type| source ---|---|--- 2026-05-11 21:52:40+00:00| published-proof-of-concept| https://github.com/amir20/dozzle/security/advisories/GHSA-3v9w-6365-9w54 2026-05-26 23:01:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mms3xjqx762w 2026-05-27...
CVE-2024-45298
Wiki.js is an open source wiki app built on Node.js. A disabled user can still gain access to a wiki by abusing the password reset function. While setting up SMTP e-mail's on my server, I tested said e-mails by performing a password reset with my test user. To my shock, not only did it let me res...
CVE-2024-45298
creationtimestamp| type| source ---|---|--- 2024-09-18 20:05:51+00:00| seen| https://t.me/cvedetector/6003...
CVE-2024-45298
Wiki.js is an open source wiki app built on Node.js. A disabled user can still gain access to a wiki by abusing the password reset function. While setting up SMTP e-mail's on my server, I tested said e-mails by performing a password reset with my test user. To my shock, not only did it let me res...
CVE-2024-45298 Disabled user can bypass lockout by requesting password reset in wiki.js
Wiki.js is an open source wiki app built on Node.js. A disabled user can still gain access to a wiki by abusing the password reset function. While setting up SMTP e-mail's on my server, I tested said e-mails by performing a password reset with my test user. To my shock, not only did it let me res...
CVE-2024-45298 Disabled user can bypass lockout by requesting password reset in wiki.js
Wiki.js is an open source wiki app built on Node.js. A disabled user can still gain access to a wiki by abusing the password reset function. While setting up SMTP e-mail's on my server, I tested said e-mails by performing a password reset with my test user. To my shock, not only did it let me res...
CVE-2024-45298
Wiki.js exposes an authentication bypass where a disabled user can regain access by abusing the password reset flow. Affected: Wiki.js 2.5.303. Root cause: password reset handling allows access despite disabled status. Remediation: upgrade to version 2.5.304 (or later). No additional exploit deta...