PT-2025-33890 · Totvs · Totvs Portal Meu Rh

Name of the Vulnerable Software and Affected Versions: TOTVS Portal Meu RH versions up to 12.1.17 Description: A flaw has been identified in the Password Reset Handler component that may allow for an open redirect. Manipulation of the redirectUrl argument can lead to a redirect to an arbitrary UR...

Movable Type 安全漏洞

Movable Type is a content management system from Movable Type, Inc. A security vulnerability exists in Movable Type that stems from the use of a low-trustworthy source, which could lead to a remote, unauthenticated attacker sending a doctored password reset email...

JVN#76729865: Multiple vulnerabilities in Movable Type

Movable Type provided by Six Apart Ltd. contains multiple vulnerabilities listed below. Use of less trusted source（CWE-348） CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 6.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Base Score 5.3 CVE-2025-53522 Open...

PT-2025-34054 · Unknown · Touch Lebanon Mobile App

Name of the Vulnerable Software and Affected Versions: Touch Lebanon Mobile App version 2.20.2 Description: A flaw exists in the password reset workflow that allows an attacker to bypass the one-time password OTP reset password mechanism. By manipulating the reset process, an unauthorized user ma...

CVE-2025-50503

The CVE-2025-50503 entry concerns Touch Lebanon Mobile App 2.20.2, where a flaw in the password reset workflow enables bypassing the OTP mechanism, potentially allowing an unauthorized user to reset a password and access an account without a legitimate authentication factor. The incident is descr...

CVE-2025-51543

An issue was discovered in Cicool builder 3.4.4 allowing attackers to reset the administrator's password via the /administrator/auth/resetpassword endpoint...

CVE-2025-52338

An issue in the default configuration of the password reset function in LogicData eCommerce Framework v5.0.9.7000 allows attackers to bypass authentication and compromise user accounts via a bruteforce attack...

CVE-2025-51539

EzGED3 3.5.0 contains an unauthenticated arbitrary file read vulnerability due to improper access control and insufficient input validation in a script exposed via the web interface. A remote attacker can supply a crafted path parameter to a PHP script to read arbitrary files from the filesystem...

PyPI Blocks 1,800 Expired-Domain Emails to Prevent Account Takeovers and Supply Chain Attacks

The maintainers of the Python Package Index PyPI repository have announced that the package manager now checks for expired domains to prevent supply chain attacks. "These changes improve PyPI's overall account security posture, making it harder for attackers to exploit expired domain names to gai...

CVE-2025-52338

An issue in the default configuration of the password reset function in LogicData eCommerce Framework v5.0.9.7000 allows attackers to bypass authentication and compromise user accounts via a bruteforce attack...

CVE-2025-51543

An issue was discovered in Cicool builder 3.4.4 allowing attackers to reset the administrator's password via the /administrator/auth/resetpassword endpoint...

CVE-2025-51539

EzGED3 3.5.0 contains an unauthenticated arbitrary file read vulnerability due to improper access control and insufficient input validation in a script exposed via the web interface. A remote attacker can supply a crafted path parameter to a PHP script to read arbitrary files from the filesystem...

PT-2025-33861 · Unknown · Cicool Builder

Name of the Vulnerable Software and Affected Versions: Cicool builder version 3.4.4 Description: An issue allows attackers to reset the administrator's password. This is achieved via the /administrator/auth/reset password API endpoint. Recommendations: As a temporary workaround, consider...

CVE-2025-52338

CVE-2025-52338 affects LogicData eCommerce Framework (v5.0.9.7000). The vulnerability stems from a misconfigured default in the password reset function, enabling an attacker to bypass authentication and compromise user accounts via brute-force attempts. CVSS v3.1 base score 5.3 (Network, Low atta...

PT-2025-33852 · Logicdata · Logicdata Ecommerce Framework

Name of the Vulnerable Software and Affected Versions: LogicData eCommerce Framework version 5.0.9.7000 Description: An issue in the default configuration of the password reset function allows attackers to bypass authentication and compromise user accounts via a bruteforce attack. Recommendations...

CVE-2025-52338

An issue in the default configuration of the password reset function in LogicData eCommerce Framework v5.0.9.7000 allows attackers to bypass authentication and compromise user accounts via a bruteforce attack...

LogicData eCommerce Framework 安全漏洞

LogicData eCommerce Framework is an e-commerce middleware from LogicData Corporation. A security vulnerability exists in LogicData eCommerce Framework version v5.0.9.7000, which stems from an improperly configured default of the password reset feature, which could lead to bypassing authentication...

CVE-2025-51539

EzGED3 3.5.0 contains an unauthenticated arbitrary file read vulnerability due to improper access control and insufficient input validation in a script exposed via the web interface. A remote attacker can supply a crafted path parameter to a PHP script to read arbitrary files from the filesystem...

PT-2025-33747

Name of the Vulnerable Software and Affected Versions: EzGED3 versions prior to 3.5.72.27183 Description: EzGED3 is susceptible to an unauthenticated arbitrary file read issue stemming from inadequate access control and insufficient input validation within a web-accessible script. An attacker can...

CVE-2025-51543

An issue was discovered in Cicool builder 3.4.4 allowing attackers to reset the administrator's password via the /administrator/auth/resetpassword endpoint...