CVE-2026-55164

Netflix Lemur before 1.9.2 stores admin-set passwords in plaintext: lemur.users.service.update() assigns the password directly to User.password without calling hash_password(), and the model only registers a bcrypt before_insert listener, not before_update. A database or backup compromise exposes...

CVE-2026-24428

The CVE-2026-24428 entry concerns Shenzhen Tenda W30E V2 firmware (up to and including V16.01.0.19(5037)) with an authorization flaw in the user management API. The concrete detail across sources is that a low-privileged authenticated user can alter the administrator password by sending a crafted...

CVE-2022-23331

In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password...

CVE-2025-67015

Incorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1 allows attackers to change the Administrator password and escalate privileges via sending a crafted POST request to /Forms/adminaccess1...

CVE-2018-25149

CVE-2018-25149 affects Microhard Systems IPn4G 1.1.0. The vulnerability is a cross-site request forgery (CSRF) in the device’s web interface that allows an attacker to induce administrative actions without user consent by tricking an authenticated user into loading a malicious page. Documented im...

Teradek Cube 安全漏洞

Teradek Cube is a video decoder from Teradek. A security vulnerability exists in Teradek Cube version 7.3.6, which stems from vulnerability to a cross-site request forgery attack that could result in a change of the administrator password...

PT-2025-51981

Name of the Vulnerable Software and Affected Versions affected versions not specified Description A flaw exists in the file upload process within the bookmark and asset rendering pipeline. An attacker can upload a malicious SVG file containing JavaScript code. When an authenticated administrator...

EUVD-2018-8180

Malware in sbrugna...

EUVD-2018-6253

Malware in sbrugna...

EUVD-2017-12337

Malware in sbrugna...

EUVD-2024-52734

Malicious code in bioql PyPI...

CVE-2018-17023

Cross-site request forgery CSRF vulnerability on ASUS GT-AC5300 routers with firmware through 3.0.0.4.38432738 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to startapply.htm...

CVE-2018-18191

Cross-site request forgery CSRF vulnerability in /admin.php?c=member=edit=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password...

CVE-2024-55076

Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password...

CVE-2024-55076

Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password...

CVE-2024-55076

Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password...

RIELLO UPS NetMan 204 跨站请求伪造漏洞

Riello Ups RIELLO UPS NetMan is a network adapter from the Italian company Riello Ups. A security vulnerability exists in RIELLO UPS NetMan version 204 02.05, which stems from the lack of proper validation of CRSF tokens and a CSRF vulnerability that allows an attacker to try to change the...

PT-2022-8690 · Asus · Asus Rt-N12+

Name of the Vulnerable Software and Affected Versions: Asus RT-N12E version 2.0.0.39 Description: The issue is related to incorrect access control. An attacker can change the administrator password without authentication through the "system.asp" and "start apply.htm" API endpoints. Recommendation...

Trendnet AC2600 访问控制错误漏洞

Trendnet AC2600 TEW-827DRU is a wireless router. version 2.08B01 of the Trendnet AC2600 TEW-827DRU contains a security vulnerability that stems from a hidden administrative command that could be exploited to force an attacker to change the administrator password...

VestaCP Elevation of Privilege Vulnerability

VestaCP is an open source hosting control panel that can be used to manage multiple websites, create and manage email accounts, FTP accounts and MySQL databases, and manage DNS records. An elevation of privilege vulnerability exists in VestaCP 0.9.8-24 and earlier versions. The vulnerability can ...