CVE-2024-57429

CVE-2024-57429 Uma vulnerabilidade de cross-site request forgery CSRF na função pjActionUpdate do PHPJabbers Cinema Booking System v2.0 permite que atacantes remotos elevem privilégios ao enganar um administrador autenticado para submeter uma requisição não autorizada. Impacto: A exploração desta...

CVE-2025-5095-POC

Come Usare: Apri Login.htm e modifica i punti in cui IP:PORT è l'indirizzo della vittima Modifica la parte var LoginVersion = "Check On The Victim Site"; con la versione della pagina della vittima, in questo modo puoi visitare la pagina della vittima e visualizzare il sorgente ATTENZIONE: QUESTA...

CVE-2025-28355

CVE-2025-28355 È stato identificato che l'applicazione https://github.com/Volmarg/personal-management-system è vulnerabile ad attacchi CSRF. Una delle molte azioni che un attaccante può eseguire è ingannare un utente legittimo per fargli eseguire una richiesta cross-site che modificherà la sua...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093203)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093203 advisory. In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request using that token to set a new admin password or make other...

CVE-2026-79673

Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an admin's profile:read access token can change the admin's password and login to obtain an unrestricted session token that...

EUVD-2026-65441

Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an admin's profile:read access token can change the admin's password and login to obtain an unrestricted session token that...

CVE-2026-79673 Ech0 before 4.4.3 Scope Bypass via profile:read Token

Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an admin's profile:read access token can change the admin's password and login to obtain an unrestricted session token that...

CVE-2026-79673

Ech0 before 4.4.3 has a scope enforcement bypass in the PUT /user endpoint. The endpoint is guarded by the profile:read scope—a read-only permission—yet it still allows write operations, including password changes . An attacker holding an admin's profile:read access token can reset that admin's p...

CVE-2026-79673 Ech0 before 4.4.3 Scope Bypass via profile:read Token

Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an admin's profile:read access token can change the admin's password and login to obtain an unrestricted session token that...

nepstech-xpon-router-CVE-2024-40119

nepstech-xpon-router-CVE-2024-40119 Autor: Subhodeep Baroi CVE-2024-40119: Vulnerabilidade CSRF no Roteador Wi-Fi Nepstech NTPL-XPON1GFEVN v1.0 Descrição CVE-2024-40119 é uma vulnerabilidade de Cross-Site Request Forgery CSRF no roteador Wi-Fi Nepstech xpon NTPL-XPON1GFEVN v1.0, firmware v2.0.1...

CVE-2020-35846

Cockpit CMS NoSQL Injection to Esecuzione Remota di Codice : CVE-2020-35846 Descrizione Cockpit CMS presenta alcune vulnerabilità NoSQL che possono essere utilizzate per scaricare le informazioni degli utenti. Queste fughe di informazioni possono essere concatenate per modificare le password degl...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users’ passwords, allowing for full domain takeover...

Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

Summary The MyAccountController::postAccountInfoForm action bound to POST /admin/edit-account-info calls $this-guard-user-update$request-except'token'. Because the controller uses except'token' rather than $request-validated or the restricted keys defined in AccountInfoRequest::validationData, an...

CVE-2026-76633

WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in...

CVE-2026-76633

WeGIA before 3.9.2 contains an authorization bypass in the password change flow. The root cause is the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. An attacker with any authenticated session can manipulate the redir parameter to point to alter...

CVE-2026-76633 WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha

WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in...

EUVD-2026-63351

WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in...

CVE-2026-76633 WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha

WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in...

CVE-2026-55164

Netflix Lemur before 1.9.2 stores admin-set passwords in plaintext: lemur.users.service.update() assigns the password directly to User.password without calling hash_password(), and the model only registers a bcrypt before_insert listener, not before_update. A database or backup compromise exposes...

CVE-2026-45791

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.sessiontoken session to remain valid for u...