CVE-2025-12285 Missing Initial Password Change

Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

CVE-2025-12285

The CVE-2025-12285 entry concerns Azure Access Technology BLU-IC2 and BLU-IC4 (through 1.19.5) with a missing initial password change. Connected sources confirm affected devices are networked access controllers from BLU-IC2/BLU-IC4 lines, and that the issue stems from not changing the initial def...

CVE-2025-12285 Missing Initial Password Change

Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

Azure Access Technology BLU-IC2和Azure Access Technology BLU-IC4 安全漏洞

The Azure Access Technology BLU-IC2 and Azure Access Technology BLU-IC4 are both networked access controllers from Azure Access Technology, USA. A security vulnerability exists in the Azure Access Technology BLU-IC2 and Azure Access Technology BLU-IC4 that stems from a missing initial password...

CVE-2025-62771

Mercku M6a devices through 2.1.0 allow password changes via intranet CSRF attacks...

CVE-2025-52079

The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /getset.ccp...

D-Link DIR-820L Access Control Error Vulnerability

The D-Link DIR-820L is a wireless router device from D-Link. An improper access control vulnerability exists in the D-Link DIR-820L version 1.06B02, which stems from the administrator password setup function not properly validating the authentication mechanism. An attacker can exploit this...

CVE-2025-62771

Mercku M6a devices through 2.1.0 allow password changes via intranet CSRF attacks...

CVE-2025-62771

Mercku M6a devices through 2.1.0 allow password changes via intranet CSRF attacks...

CVE-2025-52079

The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /getset.ccp...

CVE-2025-52079

The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /getset.ccp...

WordPress Orion SMS OTP Verification plugin elevation of privilege vulnerability

WordPress Orion SMS OTP Verification plugin is an authentication plugin for WordPress that enables user verification by sending a one-time password OTP via text message SMS. An elevation of privilege vulnerability exists in the WordPress Orion SMS OTP Verification plugin, which can be exploited b...

EUVD-2025-35216

The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /getset.ccp...

CVE-2025-52079

The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /getset.ccp...

CVE-2025-52079

CVE-2025-52079 concerns the D-Link DIR-820L router (firmware version 1.06B02). The Red Hat and NVD/CNVD entries describe an improper access control in the administrator password setting that allows an unauthenticated user to trigger an unauthenticated password change by sending a crafted POST req...

D-Link DIR-820L 安全漏洞

The D-Link DIR-820L is a wireless router device from D-Link. An improper access control vulnerability exists in the D-Link DIR-820L version 1.06B02, which stems from the administrator password setup function not properly validating the authentication mechanism. An attacker can exploit this...

CVE-2025-10742

The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for...

VulnCheck KEV: CVE-2024-20419

A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem SSM On-Prem could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process...

CVE-2025-62425 Matrix Authentication Service account password can be changed using an authenticated session without supplying the current password

MAS Matrix Authentication Service is a user management and authentication service for Matrix homeservers, written and maintained by Element. A logic flaw in matrix-authentication-service 0.20.0 through 1.4.0 allows an attacker with access to an authenticated MAS session to perform sensitive...

CVE-2025-62425

MAS (Matrix Authentication Service) is affected by a logic flaw in matrix-authentication-service 0.20.0 through 1.4.0 that lets an attacker with access to an authenticated MAS session perform sensitive operations without entering the current password (e.g., changing the password, adding/removing ...