4954 matches found
CVE-2026-13579 itsourcecode Hospital Management System patientchangepassword.php sql injection
A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /patientchangepassword.php. Executing a manipulation of the argument newpassword can lead to sql injection. The attack may be launched remotely. The...
CVE-2026-13579
CVE-2026-13579 affects itsourcecode Hospital Management System 1.0. A vulnerability exists in the file /patientchangepassword.php where manipulation of the newpassword parameter can trigger a SQL injection. The issue can be exploited remotely and the exploit is publicly available (proof-of-concep...
CVE-2026-13541 itsourcecode Hospital Management System doctorchangepassword.php sql injection
A weakness has been identified in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /doctorchangepassword.php. Executing a manipulation of the argument newpassword can lead to sql injection. The attack may be performed from remote. The exploit has been made...
Unverified Password Change
Overview Affected versions of this package are vulnerable to Unverified Password Change in the OAuth2 authentication module when the password is silently rewritten to the username upon OAuth2 re-login. An attacker can gain unauthorized access to user accounts by authenticating with both the...
GHSA-GF57-4MP6-M85X OpenAM Account Takeover via Unverified Password Change in OAuth2 Module
Summary Description An Unverified Password Change CWE-620 and Use of Weak Credentials CWE-1391 issue in OpenAM's OAuth2 authentication module silently rewrites a local user's password to the literal string of their username on OAuth2 re-login of an existing account. The default ldapService chain...
EUVD-2025-210341
Flowise before 3.0.10 affected versions 3.0.7 and earlier fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the...
EUVD-2025-210338
Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings Security section without supplying the current password or any additional verification, as the application does not enforce a...
PT-2026-52902
Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.3.2 OpenProject versions prior to 17.4.0 Description A business logic error exists in the password change behavior. This flaw allows an attacker who has achieved an active session takeover to bypass password...
GO-2026-5431 Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session in github.com/lin-snow/ech0
Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
CVE-2025-71335
Flowise before 3.0.10 affected versions 3.0.7 and earlier fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the...
CVE-2025-71328
Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings Security section without supplying the current password or any additional verification, as the application does not enforce a...
CVE-2025-71335 Flowise - Session Invalidation Failure After Password Change
Flowise before 3.0.10 affected versions 3.0.7 and earlier fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the...
CVE-2025-71335
Flowise prior to version 3.0.10 is affected. Versions 3.0.7 and earlier do not invalidate existing sessions or session tokens after a user changes their password, allowing an attacker with an active session (e.g., via a stolen token or an already-logged-in device) to remain authenticated post-pas...
CVE-2025-71335 Flowise - Session Invalidation Failure After Password Change
Flowise before 3.0.10 affected versions 3.0.7 and earlier fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the...
CVE-2025-71335
Flowise before 3.0.10 affected versions 3.0.7 and earlier fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the...
CVE-2025-71328 Flowise - Unverified Password Change via Account Settings
Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings Security section without supplying the current password or any additional verification, as the application does not enforce a...
CVE-2025-71328
Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings Security section without supplying the current password or any additional verification, as the application does not enforce a...
CVE-2025-71328
CVE-2025-71328 affects Flowise before 3.0.10. An authenticated user can change their account password via the Account Settings > Security page without providing the current password or any additional verification, because the application does not enforce a current-password check on credential ...
CVE-2025-71328 Flowise - Unverified Password Change via Account Settings
Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings Security section without supplying the current password or any additional verification, as the application does not enforce a...