CVE-2025-43856

The CVE-2025-43856 entry concerns immich, a self-hosted photo/video management solution. Affected versions are prior to 1.132.0. The root cause is that the OAuth2 state parameter is not validated, which defeats CSRF protection. When immich uses the /user-settings page as a redirect URI, an attack...

immich 安全漏洞

immich is a high-performance self-hosted photo and video management solution from Immich Open Source. A security vulnerability exists in versions prior to immich 1.132.0 that stems from a failure to check the oauth2 status parameter, which could lead to account hijacking...

CVE-2025-43856: Incorrect Implementation of Authentication Algorithm

immich is a high performance self-hosted photo and video management solution. Prior to 1.132.0, immich is vulnerable to account hijacking through oauth2, because the state parameter is not being checked. The oauth2 state parameter is similar to a csrf token, so when the user starts the login flow...

CVE-2025-4687 Account pre-hijacking through invite misuse

In Teltonika Networks Remote Management System RMS, it is possible to perform account pre-hijacking by misusing the invite functionality. If a victim has a pending invite and registers to the platform directly, they are added to the attackers company without their knowledge. The victims account a...

CVE-2025-4687

CVE-2025-4687 affects Teltonika Networks Remote Management System (RMS) prior to 5.7. The issue allows account pre-hijacking via misuse of the invite feature: if a user has a pending invite and registers directly, they are added to the attacker’s company, enabling the attacker to manage the victi...

PT-2025-23147 · Teltonika Networks · Teltonika Networks Rms

Name of the Vulnerable Software and Affected Versions: Teltonika Networks Remote Management System RMS versions prior to 5.7 Description: The issue allows for account pre-hijacking by misusing the invite functionality. If a victim has a pending invite and registers to the platform directly, they...

Teltonika Remote Management System 安全漏洞

Teltonika Remote Management System is a remote management system used by Teltonika to manage Teltonika products. A security vulnerability exists in Teltonika Remote Management System versions prior to 5.7, which stems from misuse of the invite feature and could lead to account pre-hijacking...

CVE-2023-41326

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A logged user from any profile can hijack the Kanban feature to alter any user field, and end-up with...

CVE-2021-29394

Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote authenticated users to change the password of any targeted user accounts via lack of proper authorization in the user-controlled "userID" parameter of the HTTP POST...

CVE-2021-34272

A security flaw in the 'owned' function of a smart contract implementation for RobotCoin RBTC, a tradeable Ethereum ERC20 token, allows attackers to hijack victim accounts and arbitrarily increase the digital supply of assets...

CVE-2020-35591

Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the...

CVE-2020-21238

An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks...

CVE-2020-21237

An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks...

CVE-2013-2318

The Content Provider in the MovatwiTouch application before 1.793 and MovatwiTouch Paid application before 1.793 for Android does not properly restrict access to authorization information, which allows attackers to hijack Twitter accounts via a crafted application...

CVE-2012-0286

Cross-site request forgery CSRF vulnerability in Stoneware webNetwork before 6.0.8.0 allows remote attackers to hijack the authentication of unspecified victims for requests that modify user accounts...

CVE-2010-5093

MemberProfileForm in security/Member.php in SilverStripe 2.3.x before 2.3.7 allows remote attackers to hijack user accounts by saving data using the email address ID of another user...

CVE-2005-4688

PunBB 1.2.9 does not require password entry when changing the e-mail address in an account's profile, which might allow an attacker to make an address change via a hijacked login session...

CVE-2025-3759

Endpoint /cgi-bin-igd/netcoreset.cgi which is used for changing device configuration is accessible without authentication. This poses a significant security threat allowing for e.g: administrator account hijacking or AP password changing. The vendor was contacted early about this disclosure but d...

CVE-2025-3759: Missing Authentication for Critical Function

Endpoint /cgi-bin-igd/netcoreset.cgi which is used for changing device configuration is accessible without authentication. This poses a significant security threat allowing for e.g: administrator account hijacking or AP password changing. The vendor was contacted early about this disclosure but d...

PT-2025-20372 · Netis Systems · Wf2220

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The endpoint /cgi-bin-igd/netcore set.cgi is used for changing device configuration and is accessible without authentication, posing a significant security threat. This could allow for...