CVE-2025-2304-POC

CVE-2025-2304-POC CVE-2025-2304 の PoC — Camaleon CMS 2.9.0 におけるパスワード変更エンドポイントでのマスアサインメントによる権限昇格。 脆弱性 /admin/users/:id/updatedajax エンドポイントは、モデル更新に渡す前に role パラメータをフィルタリングしないため、認証されたユーザーであれば誰でも管理者に権限昇格できます。 使用方法 root@kitploit: python3 CVE-2025-2304-POC.py -u http://target.htb --username bob --passwo...

CVE-2025-14340

XSS per appropriazione dell'account admin CVE-2025-14340 Una vulnerabilità di Cross-Site Scripting nell'Interfaccia REST di Amministrazione di Payara permette l'esecuzione di JavaScript controllato dall'attaccante, portando all'appropriazione dell'account admin. A causa di: 1. Il pannello utilizz...

CVE-2026-11922

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

PT-2026-64225

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

CVE-2026-14701

CVE-2026-14701 affects code-projects Internship Management System 1.0. The vulnerability is in the Password Change Endpoint (employer/details/change_password.php) where manipulating the Current argument leads to SQL injection. The issue is exploitable remotely and the exploit is publicly availabl...

CVE-2026-14701

A vulnerability was detected in code-projects Internship Management System 1.0. This affects an unknown function of the file employer/details/changepassword.php of the component Password Change Endpoint. The manipulation of the argument Current results in sql injection. The attack can be executed...

CVE-2026-14701 code-projects Internship Management System Password Change Endpoint change_password.php sql injection

A vulnerability was detected in code-projects Internship Management System 1.0. This affects an unknown function of the file employer/details/changepassword.php of the component Password Change Endpoint. The manipulation of the argument Current results in sql injection. The attack can be executed...

CVE-2026-56780

Modoboa prior to version 2.9.0 contains an insecure direct object reference in the PUT /api/v1/accounts/{pk}/password/ API. This flaw allows domain administrators to bypass object‑level access controls and change any user’s password, enabling full account takeover by resetting superadmin password...

Exploit for CVE-2025-2304

CVE-2025-2304-POC PoC for CVE-2025-2304 — Camaleon CMS 2.9.0...

CVE-2026-36607

Mercusys AC12G EU V1 router with firmware AC12GEUV1200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint code=10, which lacks the rate limiting applied to the login endpoint code=7. An attacker on the adjacent network can attempt unlimited passwords without...

EUVD-2026-34146

Mercusys AC12G EU V1 router with firmware AC12GEUV1200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint code=10, which lacks the rate limiting applied to the login endpoint code=7. An attacker on the adjacent network can attempt unlimited passwords without...

Mercusys AC12G 授权问题漏洞

The Mercusys AC12G is a Gigabit wireless router produced by the Chinese company Mercusys. The Mercusys AC12G EU V1 AC12G EU V1 version has a security vulnerability. This vulnerability stems from the lack of rate limiting on the TDDP password change endpoint, which may allow neighboring network...

CVE-2026-36607

Mercusys AC12G EU V1 router with firmware AC12GEUV1200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint code=10, which lacks the rate limiting applied to the login endpoint code=7. An attacker on the adjacent network can attempt unlimited passwords without...

CVE-2026-36607

Mercusys AC12G EU V1 router with firmware AC12GEUV1200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint code=10, which lacks the rate limiting applied to the login endpoint code=7. An attacker on the adjacent network can attempt unlimited passwords without...

CVE-2026-38566

CVE-2026-38566 affects HireFlow v1.2. The issue is CSRF on all state-changing POST endpoints (e.g., /profile password change, /candidates/delete/, /feedback/add/, /interviews/add) due to missing CSRF token validation and no SESSION_COOKIE_SAMESITE configuration. Root cause: CSRF token validation ...

CVE-2026-22603 OpenProject has no protection against brute-force attacks in the Change Password function

OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, OpenProject’s unauthenticated password-change endpoint /account/changepassword was not protected by the same brute-force safeguards that apply to the normal login form. In affected versions, an attacker...

EUVD-2026-1884

OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, OpenProject’s unauthenticated password-change endpoint /account/changepassword was not protected by the same brute-force safeguards that apply to the normal login form. In affected versions, an attacker...

OpenProject 安全漏洞

OpenProject is a web-based project management software from OpenProject Open Source. A security vulnerability exists in OpenProject versions prior to 16.6.2 that stems from a lack of brute force protection in an unprotected password change endpoint, which could lead to account cracking and...

CVE-2025-63207

The CVE-2025-63207 affects R.V.R Elettronica TEX: firmware TEXL-000400 and Web GUI TLAN-000400. It describes a broken access control flaw due to improper authentication checks on the /_Passwd.html endpoint, allowing an unauthenticated POST that can change Admin, Operator, and User passwords and p...

CVE-2025-63800

The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation. When an authenticated user omits or leaves the password and repeatpassword parameters empty in the password change request, the...