PT-2026-103697

Comelit Multi-User Gateway for VIP System model 1456B firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer administrator account password...

CVE-2025-28371: Improper Access Control

EnGenius ENH500 AP 2T2R V3.0 FW3.7.22 is vulnerable to Incorrect Access Control via the password change function. The device fails to validate the current password, allowing an attacker to submit a password change request with an invalid current password and set a new password...

PT-2025-20728 · Flytxt · Flytxt Neon-Dx

Name of the Vulnerable Software and Affected Versions: Flytxt NEON-dX version 0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c Description: The issue concerns the userId parameter in the change password function, allowing attackers to execute brute force attacks to discover user passwords. This could potential...

CVE-2024-4311

zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to the...

CVE-2024-42849

An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change function...

CVE-2024-42849: Uncontrolled Resource Consumption

An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change function...

CVE-2024-42850: Weak Password Requirements

An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements...

CVE-2024-40119: Cross-Site Request Forgery (CSRF)

Nepstech Wifi Router xpon terminal model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery CSRF vulnerability in the password change function, which allows remote attackers to change the admin password without the user's consent, leading to a potential account takeover...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the admin Password Change Function...

CVE-2023-44811

Cross Site Request Forgery CSRF vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the admin Password Change Function...

CVE-2023-44811: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the admin Password Change Function...

PT-2023-29299

Name of the Vulnerable Software and Affected Versions MooSocial version 3.1.8 Description A Cross Site Request Forgery CSRF issue allows a remote attacker to execute arbitrary code and obtain sensitive information via the admin Password Change Function. This can be exploited to gain unauthorized...

CVE-2023-44811

Cross Site Request Forgery CSRF vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the admin Password Change Function...

CVE-2019-20481

The connected Red Hat advisories confirm CVE-2019-20481 affects the Miele XGW 3000 ZigBee Gateway before 2.4.0, where the Password Change Function does not require the old password. This is stated to be exploitable in conjunction with CVE-2019-20480 (CSRF). The combined entries indicate an auth-r...

PT-2020-10466

Name of the Vulnerable Software and Affected Versions MIELE XGW 3000 ZigBee Gateway versions prior to 2.4.0 Description The issue concerns the Password Change Function, which does not require knowledge of the old password. This can be exploited, potentially allowing unauthorized access...

CVE-2019-20481: Improper Authentication

In MIELE XGW 3000 ZigBee Gateway before 2.4.0, the Password Change Function does not require knowledge of the old password. This can be exploited in conjunction with CVE-2019-20480...

PT-2019-6818 · Freedesktop +3 · Accountsservice +3

Name of the Vulnerable Software and Affected Versions: AccountService version 0.6.37 Description: An issue exists in the user change password authorized cb function in user.c, which could let a local user obtain encrypted passwords. Recommendations: For version 0.6.37, consider restricting access...

CVE-2018-0391: Improper Authorization

A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to cause the system to become inoperable. The vulnerability is due to insufficient validation of a password change request. An attacker could exploit this...

PT-2018-1529

Name of the Vulnerable Software and Affected Versions Cisco Prime Collaboration Provisioning versions 12.2 and prior Description A vulnerability in the password change function could allow an authenticated, remote attacker to cause the system to become inoperable due to insufficient validation of...

CVE-2017-17056

The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'passwordchange' function of the Modify Password component, reachable via the oldpassword, newpassword1, and newpassword2 parameters to the /accounts/passwordchange/ URI. An...