CVE-2026-55164

Netflix Lemur before 1.9.2 stores admin-set passwords in plaintext: lemur.users.service.update() assigns the password directly to User.password without calling hash_password(), and the model only registers a bcrypt before_insert listener, not before_update. A database or backup compromise exposes...

CVE-2026-24428

The CVE-2026-24428 entry concerns Shenzhen Tenda W30E V2 firmware (up to and including V16.01.0.19(5037)) with an authorization flaw in the user management API. The concrete detail across sources is that a low-privileged authenticated user can alter the administrator password by sending a crafted...

CVE-2022-23331

In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password...

CVE-2025-67015

Incorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1 allows attackers to change the Administrator password and escalate privileges via sending a crafted POST request to /Forms/adminaccess1...

CVE-2018-25149

CVE-2018-25149 affects Microhard Systems IPn4G 1.1.0. The vulnerability is a cross-site request forgery (CSRF) in the device’s web interface that allows an attacker to induce administrative actions without user consent by tricking an authenticated user into loading a malicious page. Documented im...

Teradek Cube 安全漏洞

Teradek Cube is a video decoder from Teradek. A security vulnerability exists in Teradek Cube version 7.3.6, which stems from vulnerability to a cross-site request forgery attack that could result in a change of the administrator password...

PT-2025-51981

Name of the Vulnerable Software and Affected Versions affected versions not specified Description A flaw exists in the file upload process within the bookmark and asset rendering pipeline. An attacker can upload a malicious SVG file containing JavaScript code. When an authenticated administrator...

EUVD-2018-8180

Malware in sbrugna...

EUVD-2018-6253

Malware in sbrugna...

EUVD-2017-12337

Malware in sbrugna...

EUVD-2024-52734

Malicious code in bioql PyPI...

CVE-2025-10204: Missing Authentication for Critical Function

A vulnerability has been discovered in AC Smart II where passwords can be changed without authorization. This page contains a hidden form for resetting the administrator password. The attacker can manipulate the page using developer tools to display and use the form. This form allows you to chang...

CVE-2018-17023

Cross-site request forgery CSRF vulnerability on ASUS GT-AC5300 routers with firmware through 3.0.0.4.38432738 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to startapply.htm...

CVE-2018-18191

Cross-site request forgery CSRF vulnerability in /admin.php?c=member=edit=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password...

CVE-2024-55076

Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password...

CVE-2024-55076

Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password...

CVE-2024-55076

Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password...

CVE-2024-41344: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate privileges...

CVE-2023-37131: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF in the component /public/admin/profile/update.html of YznCMS v1.1.0 allows attackers to arbitrarily change the Administrator password via a crafted POST request...

RIELLO UPS NetMan 204 跨站请求伪造漏洞

Riello Ups RIELLO UPS NetMan is a network adapter from the Italian company Riello Ups. A security vulnerability exists in RIELLO UPS NetMan version 204 02.05, which stems from the lack of proper validation of CRSF tokens and a CSRF vulnerability that allows an attacker to try to change the...