4997 matches found
CVE-2025-3979 dazhouda lecms Password Change index.php cross-site request forgery
A vulnerability classified as problematic has been found in dazhouda lecms 3.0.3. This affects an unknown part of the file /index.php?my-password-ajax-1 of the component Password Change Handler. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely...
Lecms 安全漏洞
Lecms is a multi-million large data bearing web content management system developed by Lecms Inc. in PHP language. A security vulnerability exists in Lecms version 3.0.3, which originates from the password change processor component in file/index.php?my-password-ajax-1 is vulnerable to cross-site...
PT-2025-18007 · Unknown · Dazhouda Lecms
Name of the Vulnerable Software and Affected Versions: dazhouda lecms version 3.0.3 Description: A problematic issue has been found in the Password Change Handler component, affecting the /index.php?my-password-ajax-1 file. This leads to cross-site request forgery and can be initiated remotely. T...
CVE-2025-3793
The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly validating a user's identity prior to updating their password through the 'bpforcepasswordajax' function in all versions up to, and including, 0.1. This makes i...
CVE-2025-3849
A vulnerability classified as problematic was found in YXJ2018 SpringBoot-Vue-OnlineExam 1.0. This vulnerability affects unknown code of the file /api/studentPWD. The manipulation of the argument studentId leads to unverified password change. The attack can be initiated remotely. The exploit has...
CVE-2025-3793
The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly validating a user's identity prior to updating their password through the 'bpforcepasswordajax' function in all versions up to, and including, 0.1. This makes i...
CVE-2025-3603
The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for...
CVE-2025-3793
CVE-2025-3793 affects the Buddypress Force Password Change plugin for WordPress (versions up to 0.1). The vulnerability enables authenticated users (subscriber level or higher) to perform an account takeover by exploiting insufficient identity validation in the bp_force_password_ajax password-upd...
CVE-2025-3793 Buddypress Force Password Change <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update
The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly validating a user's identity prior to updating their password through the 'bpforcepasswordajax' function in all versions up to, and including, 0.1. This makes i...
PT-2025-17718 · WordPress · Frontend Login/Registration Blocks
Name of the Vulnerable Software and Affected Versions: Frontend Login and Registration Blocks plugin for WordPress versions up to, and including, 1.0.7 Description: The issue is related to privilege escalation via account takeover due to the plugin not properly validating a user's identity prior ...
WordPress Buddypress Force Password Change plugin <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update vulnerability
Authenticated Subscriber+ Account Takeover via Password Update vulnerability discovered by kr0d in WordPress Plugin Buddypress Force Password Change versions = 0.1...
CVE-2025-3849
A vulnerability classified as problematic was found in YXJ2018 SpringBoot-Vue-OnlineExam 1.0. This vulnerability affects unknown code of the file /api/studentPWD. The manipulation of the argument studentId leads to unverified password change. The attack can be initiated remotely. The exploit has...
CVE-2025-3849
CVE-2025-3849 affects YXJ2018 SpringBoot-Vue-OnlineExam 1.0 with a vulnerability in the file /api/studentPWD. The manipulation of the parameter studentId enables an unverified password change, and the attack can be initiated remotely. Public reports/entries confirm the existence of this issue acr...
CVE-2025-3849 YXJ2018 SpringBoot-Vue-OnlineExam studentPWD unverified password change
A vulnerability classified as problematic was found in YXJ2018 SpringBoot-Vue-OnlineExam 1.0. This vulnerability affects unknown code of the file /api/studentPWD. The manipulation of the argument studentId leads to unverified password change. The attack can be initiated remotely. The exploit has...
SpringBoot-Vue-OnlineExam 安全漏洞
SpringBoot-Vue-OnlineExam is an online exam system by Yu Personal Developer. A security vulnerability exists in SpringBoot-Vue-OnlineExam version 1.0, which stems from an unauthenticated password change due to manipulation of the studentId parameter in file/api/studentPWD...
PT-2025-17471 · Unknown · Yxj2018 Springboot-Vue-Onlineexam
Name of the Vulnerable Software and Affected Versions: YXJ2018 SpringBoot-Vue-OnlineExam version 1.0 Description: A vulnerability was found in YXJ2018 SpringBoot-Vue-OnlineExam, affecting unknown code of the file "/api/studentPWD". The manipulation of the studentId argument leads to unverified...
Exploit for Cross-Site Request Forgery (CSRF) in Personal-Management-System Personal_Management_System
CVE-2025-28355 It was identified that the https://github.com/V...
Unspecified Vulnerability in Siemens SENTRON 7KT PAC1260 Data Manager (CNVD-2025-07815)
Siemens SENTRON 7KT PAC1260 Data Manager is a device for power monitoring and energy management from Siemens Germany. A security vulnerability exists in the Siemens SENTRON 7KT PAC1260 Data Manager that stems from a web interface of the affected device that allows the login password to be changed...
Unspecified Vulnerability in Siemens SENTRON 7KT PAC1260 Data Manager
Siemens SENTRON 7KT PAC1260 Data Manager is a device for power monitoring and energy management from Siemens Germany. A security vulnerability exists in the Siemens SENTRON 7KT PAC1260 Data Manager that stems from a web interface of the affected device that allows the login password to be changed...