EUVD-2024-47123

Malicious code in bioql PyPI...

EUVD-2024-54752

Malicious code in bioql PyPI...

EUVD-2021-31642

Malicious code in bioql PyPI...

EUVD-2025-20237

Malicious code in bioql PyPI...

EUVD-2023-29133

Malicious code in bioql PyPI...

EUVD-2025-11005

Malicious code in bioql PyPI...

EUVD-2023-54088

Malicious code in bioql PyPI...

CVE-2025-56676

TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one user can be used to log in as another user, due to improper validation of token-user linkage. This allows remote attackers to gain...

CVE-2025-56676

TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset feature. The reset token is not correctly bound to the requesting account and may be accepted for other user emails during login, allowing an attacker to log in as any user and potentially escalate privile...

CVE-2025-5931

The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.5. This is due to the plugin not properly validating a user's identity prior to updating their password during a staff password reset. This makes it possible for...

CVE-2025-5931 Dokan Pro <= 4.0.5 - Authenticated (Vendor+) Privilege Escalation

The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.5. This is due to the plugin not properly validating a user's identity prior to updating their password during a staff password reset. This makes it possible for...

CVE-2025-50503

A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism. By manipulating the reset process, an unauthorized user may be able to reset the password and gain access to the account without needing to provide ...

CVE-2025-50503

A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism. By manipulating the reset process, an unauthorized user may be able to reset the password and gain access to the account without needing to provide ...

PT-2025-34054 · Unknown · Touch Lebanon Mobile App

Name of the Vulnerable Software and Affected Versions: Touch Lebanon Mobile App version 2.20.2 Description: A flaw exists in the password reset workflow that allows an attacker to bypass the one-time password OTP reset password mechanism. By manipulating the reset process, an unauthorized user ma...

PT-2025-33852 · Logicdata · Logicdata Ecommerce Framework

Name of the Vulnerable Software and Affected Versions: LogicData eCommerce Framework version 5.0.9.7000 Description: An issue in the default configuration of the password reset function allows attackers to bypass authentication and compromise user accounts via a bruteforce attack. Recommendations...

CVE-2025-50594

An issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Management System EMR 3.2 allowing attackers to reset any account password...

CVE-2025-50594

An issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Management System EMR 3.2 allowing attackers to reset any account password...

PT-2025-32271 · Linkjoin · Linkjoin

Name of the Vulnerable Software and Affected Versions: LinkJoin versions through 882f196 Description: LinkJoin lacks type checking in the password reset functionality. Recommendations: Apply updates to versions prior to 882f196...

PT-2025-31557 · Sielox · Sielox Anyware

Name of the Vulnerable Software and Affected Versions: Sielox AnyWare version 2.1.2 Description: The software contains a SQL injection issue via the email address field of the password reset form. Recommendations: Apply input validation and sanitization to the email address field in the password...

CVE-2024-34327

Sielox AnyWare v2.1.2 is affected by CVE-2024-34327, a SQL injection through the email field in the password-reset form. The connected exploit document provides a time-based blind PoC targeting the POST endpoint /auth/password-reset-token.php, using the email parameter and a SLEEP() payload to de...