PT-2024-37350 · Unknown · Nasirkhan Laravel Starter

Name of the Vulnerable Software and Affected Versions: nasirkhan Laravel Starter versions up to 11.8.0 Description: A vulnerability was found in the Password Reset Handler component, specifically affecting some unknown functionality of the file /forgot-password. The manipulation of the Email...

PT-2024-25996 · Sunhillo · Sunhillo Sureline

Name of the Vulnerable Software and Affected Versions: Sunhillo SureLine versions through 8.10.0 Description: The issue allows for cgi/usrPasswd.cgi userid change XSS within the Forgot Password feature. This can be exploited through the /cgi/usrPasswd.cgi endpoint, specifically targeting the user...

PT-2024-3458

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 18.12.13 Description The issue is related to an improper limitation of a pathname to a restricted directory, also known as a path traversal vulnerability. This allows a remote attacker to execute arbitrary code b...

CVE-2024-33856

An issue was discovered in Logpoint before 7.4.0. An attacker can enumerate a valid list of usernames by observing the response time at the Forgot Password endpoint...

PT-2024-25511 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.4.0 Description: An issue was discovered in Logpoint where an attacker can enumerate a valid list of usernames by observing the response time at the "Forgot Password" endpoint. Recommendations: For versions prior ...

Exploit for CVE-2023-44792

CVE-2023-45503 Vulnerability Details Overview In Macrob7...

BDTASK G-Prescription Gynaecology & OBS Consultation Software Cross-Site Request Forgery Vulnerability

BDTASK G-Prescription Gynaecology & OBS Consultation Software is a prescription gynecology and OBS consultation software from BDTASK Bangladesh. A cross-site request forgery vulnerability exists in BDTASK G-Prescription Gynaecology & OBS Consultation Software version 1.0, which stems from the fac...

PT-2024-21391 · Fullstackhero · Webapi Boilerplate

Name of the Vulnerable Software and Affected Versions: FullStackHero's WebAPI Boilerplate versions 1.0.0 through 1.0.1 Description: A host header injection issue in the forgot password function allows attackers to leak the password reset token via a crafted request. Recommendations: For versions...

ipa: Invalid CSRF protection

A Cross-site request forgery vulnerability exists in ipa/session/loginpassword in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During...

ipa: Invalid CSRF protection

A Cross-site request forgery vulnerability exists in ipa/session/loginpassword in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During...

UBUNTU-CVE-2023-5455

A Cross-site request forgery vulnerability exists in ipa/session/loginpassword in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During...

GHSA-99PC-69Q9-JXF2 Elasticsearch allows insertion of sensitive information into log files when using deprecated URIs

Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords...

PT-2023-26654

Name of the Vulnerable Software and Affected Versions msaad1999's PHP-Login-System version 2.0.1 Description A reflected cross-site scripting XSS issue allows remote attackers to execute arbitrary JavaScript in the web browser of a user. This is achieved by including a malicious payload into the...

PT-2023-28048 · Ruijie · Ruijie Rg-Ew1200G

Name of the Vulnerable Software and Affected Versions: Ruijie RG-EW1200G version 1.01B1P5 Description: A critical issue has been found in the Administrator Password Handler component, specifically affecting an unknown functionality of the file "/api/sys/set passwd". This leads to improper access...

CVE-2023-34927

Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery CSRF in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL...

CVE-2021-36436

An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via submission to the forgotten-password endpoint...

CVE-2021-36436

An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via submission to the forgotten-password endpoint...

Session fixation

An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via submission to the forgotten-password endpoint...

CVE-2021-36436

An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via submission to the forgotten-password endpoint...

PT-2023-12274 · Unknown · Mobicint Backend For Credit Unions

Name of the Vulnerable Software and Affected Versions: Mobicint Backend for Credit Unions version 3 Description: An issue in the software allows attackers to retrieve partial email addresses and user-entered information via submission to the "forgotten-password endpoint". Recommendations: For...