Security Bulletin: MaaS360 mobile apps (iOS and Android) are able to bypass authentication by using deep link from the browser.

Summary MaaS360 mobile apps iOS and Android are able to bypass authentication by using deep link from the browser. Vulnerability Details CVEID:CVE-2023-42021 DESCRIPTION: The MaaS360 iOS application could allow an attacker to bypass authentication mechanisms by exploiting the password reset...

OctoberCMS - Account Takeover

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5. id:...

WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation

Privilege escalation vulnerability exists in the Frontend Login and Registration Blocks plugin for WordPress versions = 1.0.7. An unauthenticated attacker can exploit the AJAX endpoint flrblocksusersettingshandleajaxcallback to change the administrator's email address. Subsequently, the attacker...

LiquidFiles < 4.2 - User Enumeration via Password Reset

LiquidFiles filetransfer server before 4.2 contains a user enumeration vulnerability caused by distinguishable responses in password reset functionality, letting unauthenticated attackers enumerate valid user accounts, exploit requires no authentication. id: CVE-2025-56132 info: name: LiquidFiles...

Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover

Hippoo Mobile App for WooCommerce WordPress plugin = 1.9.4 contains an authentication bypass caused by logic conflation in user permission checks, letting unauthenticated attackers take over administrator accounts via REST API password reset. id: CVE-2026-10580 info: name: Hippoo Mobile App for...

LG LED Assistant - Unauthenticated Password Reset

The /api/changePw endpoint in LG LED Assistant allows unauthenticated password resets when requests are considered to come from localhost. An attacker can spoof the X-Forwarded-For header with value 127.0.0.1 to trigger the behavior and receive a success response. id: CVE-2024-2862 info: name: LG...

iTop - User Enumeration via REST Endpoint

From the webservices/rest.php file, several operations are accessible from an unauthenticated user. One of them is doresetpwd, allowing to reset a user password. This feature can be abused to perform user enumeration when a non-existent user is provided. id: CVE-2024-51739 info: name: iTop - User...

NocoDB < 0.258.0 - Reflected XSS in Password Reset

NocoDB versions before 0.258.0 contain a reflected cross-site scripting caused by insecure use of '\u003C%-' in resetPassword.ts, letting attackers execute malicious scripts in victims' browsers, exploit requires sending crafted requests to /api/v1/db/auth/password/reset/:tokenId. id:...

Profile Builder < 3.4.9 - Improper Authentication

The Profile Builder plugin before 3.4.9 for WordPress allows unauthenticated attackers to gain administrative access by exploiting an improper authentication vulnerability in the password reset functionality. An attacker can reset the password of any user, including administrators, without proper...

Piwigo - User Enumeration via Password Reset

Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at...

BMC FootPrints - Authentication Bypass

BMC FootPrints versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability in the password reset functionality. Unauthenticated attackers can access the /footprints/servicedesk/passwordreset/request/ endpoint to obtain a valid SECTOKEN session cookie without proper...

CVE-2026-27462

Combodo iTop , a web-based IT service management tool, is vulnerable to user enumeration via its password reset mechanism prior to version 3.2.3. The root cause is that the application returns different responses for valid and invalid usernames depending on multiple factors during the reset proce...

CVE-2026-27462 Combodo iTop: User enumeration via password reset

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3...

CVE-2026-72843

EverShop 's updateCustomer route (packages/evershop/src/modules/customer/api/updateCustomer/route.json) is declared "access": "public", so the admin auth middleware calls next() without verifying the caller and no session guard protects the route. The handler in updateCustomer.js loads a customer...

CVE-2026-69183

Monkeytype (a typing test application) versions 26.26.0 and earlier contain a rate-limit bypass in the backend key generator (backend/src/middlewares/rate-limit.ts). The generator prioritizes client-controlled cf-connecting-ip and x-forwarded-for headers over the trust-proxy-derived req.ip, allow...

WordPress Chama plugin < 1.0.13 - Unauthenticated Arbitrary User Password Reset vulnerability

Unauthenticated Arbitrary User Password Reset vulnerability discovered by moonge in WordPress Plugin ChamaWP versions 1.0.13...

CVE-2026-53547

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table...

CVE-2026-53547 Termix: Account Takeover via Global Settings Disclosure

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table...

CVE-2026-53547

A low-privileged authenticated user on Termix (prior to 2.3.2) can call POST /database/export to retrieve a global settings table containing reset_code_ and temp_reset_token_ artifacts for other accounts, enabling account takeover and admin compromise via the normal password-reset flow. Upgrade t...

EUVD-2026-62856

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table...