CVE-2025-5931

CVE-2025-5931 : Dokan Pro (WordPress)

WordPress plugin Dokan Pro 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2017-8295

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2017-15572

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information password reset tokens by reading a Referer log, because...

Linux Distros Unpatched Vulnerability : CVE-2016-7965

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remot...

CVE-2025-52395

An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to validate the identity of the requester properly...

CVE-2025-55706

URL redirection to untrusted site 'Open Redirect' issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to an arbitrary URL...

CVE-2025-53522

Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker...

CVE-2025-50503

A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism. By manipulating the reset process, an unauthorized user may be able to reset the password and gain access to the account without needing to provide ...

CVE-2025-9193

A flaw has been found in TOTVS Portal Meu RH up to 12.1.17. Impacted is an unknown function of the component Password Reset Handler. Executing manipulation of the argument redirectUrl can lead to open redirect. The attack may be performed from a remote location. The exploit has been published and...

CVE-2025-52395

An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to validate the identity of the requester properly...

CVE-2025-55366

Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal privilege escalation attack...

CVE-2025-52338

An issue in the default configuration of the password reset function in LogicData eCommerce Framework v5.0.9.7000 allows attackers to bypass authentication and compromise user accounts via a bruteforce attack...

CVE-2025-52395

An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to validate the identity of the requester properly...

CVE-2025-52395

An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to validate the identity of the requester properly...

Roadcube API 安全漏洞

Roadcube API is a management interface software from Roadcube Greece. A security vulnerability exists in the Roadcube API v.1 version that stems from a password reset API endpoint that does not validate the identity of the requester, which could lead to the execution of arbitrary code...

PT-2025-34234 · Unknown · Roadcute Api

Name of the Vulnerable Software and Affected Versions: Roadcute API version 1 Description: An issue in the application allows a remote attacker to execute arbitrary code via an insecure password reset API endpoint. The endpoint fails to validate the identity of the requester properly...

CVE-2025-52395

CVE-2025-52395 affects Roadcute API v1. The vulnerability arises from an insecure password-reset endpoint that fails to validate the requester’s identity, enabling a remote attacker to execute arbitrary code. The issue is rated CVSS v3.1: 9.8 (CRITICAL) with network attack, no privileges required...

CVE-2025-55366

Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal privilege escalation attack...

CVE-2025-50503

A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism. By manipulating the reset process, an unauthorized user may be able to reset the password and gain access to the account without needing to provide ...