CVE-2026-86260

CVE-2026-86260 affects the Password Recovery component of sfturing hosp_order (a Java/SSM-based hospital order management system). The flaw resides in the modifyPassWord function within ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java, where a password can be changed without proper...

CVE-2026-86260 sfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password change

A security flaw has been discovered in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function modifyPassWord of the file ssmpro/src/main/java/cn/sfturing/web/CommonUserController.java of the component Password Recovery. Performing a manipulation...

CVE-2026-86187

WWBN AVideo generates passwords for external-login accounts using rand instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing...

CVE-2026-75135 UpSignOn < 7.19.0 Sensitive Key Retention in Memory

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers ca...

EUVD-2026-70260

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers ca...

EUVD-2026-69722

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full...

CVE-2026-84480

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full...

CVE-2026-84480 WWBN AVideo Password Recovery Token Expiration Bypass

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full...

CVE-2026-84480 WWBN AVideo Password Recovery Token Expiration Bypass

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full...

CVE-2026-84480

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php , allowing an attacker who obtains a recovery token to use it indefinitely to reset a target account's password and gain full account access . The vulnerability is network-exploitable with low complex...

PT-2026-84539

Name of the Vulnerable Software and Affected Versions WWBN AVideo affected versions not specified Description Insufficient validation of password recovery token expiration occurs in the 'userRecoverPassSave.json.php' endpoint. This allows an attacker who has obtained a recovery token to use it...

CVE-2026-82615

A vulnerability has been found in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function Customer::findphone of the file /passwordrecover.php of the component Password Recovery Interface. The manipulation of the argument phonenumber leads to sql injection. Remote...

CVE-2026-82615

itsourcecode Online Medicine Delivery System 1.0 is affected by a SQL injection vulnerability in the Password Recovery Interface . The flaw resides in the Customer::find_phone function within /passwordrecover.php, where unsanitized input in the phonenumber argument is passed to a database query. ...

EUVD-2026-68352

A vulnerability has been found in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function Customer::findphone of the file /passwordrecover.php of the component Password Recovery Interface. The manipulation of the argument phonenumber leads to sql injection. Remote...

CVE-2026-82615 itsourcecode Online Medicine Delivery System Password Recovery passwordrecover.php find_phone sql injection

A vulnerability has been found in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function Customer::findphone of the file /passwordrecover.php of the component Password Recovery Interface. The manipulation of the argument phonenumber leads to sql injection. Remote...

Moderate: Red Hat Security Advisory: pam security update

An update for pam is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module

A flaw was found in Linux-PAM's pamuserdb module. This vulnerability, categorized as an Observable Timing Discrepancy CWE-208, allows a local or network-adjacent attacker to recover plaintext passwords. By repeatedly attempting authentication and measuring response-timing differences during...

Moderate: Red Hat Security Advisory: pam security update

An update for pam is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...

linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module

A flaw was found in Linux-PAM's pamuserdb module. This vulnerability, categorized as an Observable Timing Discrepancy CWE-208, allows a local or network-adjacent attacker to recover plaintext passwords. By repeatedly attempting authentication and measuring response-timing differences during...

Moderate: Red Hat Security Advisory: pam security update

An update for pam is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...