Wheat Pro Android App Has Logic Design Flaw

Wheat Pro app is a mobile office software that integrates PV plant monitoring, work order processing, PV plant troubleshooting and other functions. Wheat Pro Android App has a logic flaw vulnerability. Allows attackers to exploit the vulnerability to reset any enterprise power plant password with...

Arbitrary Account Password Reset Vulnerability in PV Guard Android APP

PV Guard is a PV monitoring and operation management platform based on big data and knowledge base. The PV Guard Android APP has an arbitrary account password reset vulnerability, which allows attackers to exploit the vulnerability to change the password of the other party's cell phone number onl...

NiuShop_b2c_data_release has multiple vulnerabilities

NiuShop open source mall system is by Shanxi Niu Cool Information Technology Co., Ltd. completely independent design, research and development of a set of PHP open source e-commerce system . NiuShopb2cdatarelease exists to bypass the payment vulnerability , file upload vulnerability , arbitrary...

Logic Design Vulnerability in ECS Online Learning System v3.1.0

E-learning Online Learning System is an online learning platform system developed with thinkphp+bootstrap as the framework. E-learning system v3.1.0 has a logical design vulnerability that can be exploited by attackers to reset any user's password and obtain sensitive user information...

Jinan government services micro-portal has arbitrary password reset vulnerability

Jinan government services micro-portal, able to release the latest information of Jinan Municipal Government Service Center Portal in a timely manner, the content of which includes clerical services, government information disclosure, communication and interaction, and satisfaction evaluation. It...

ist.mit.edu XSS vulnerability

Vulnerable URL: http://ist.mit.edu/?q=user/password/" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 02.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check ist.mit.edu SSL...

Unauthorized Access

WordPress is vulnerable to unauthorized access. The attack is possible because the library uses the SERVERNAME variable to get the hostname of the server for PHP mail functions, allowing an attacker to modify the hostname of his choice and trigger a password reset function. However, the attack ca...

arxius: No Email Verification and No email sent on Forget Pasword

I noticed that when i sign up on arxius.io,it didnt verify email and when i reset password,i didnt receive any email...

Beauty Camera App Has Design Logic Flaws

Beauty Camera is a beauty camera with special effects filters under Guangzhou Beauty Information Technology Co. There is a design logic vulnerability in Beauty Camera APP, which can be exploited by attackers to arbitrarily register users and reset passwords...

Legal Robot: No error or notification on Reset password page

Hello I found that there is no error occurring at Reset password page. There should error occur when user enter the wrong email-id or the entered password is used in 180 previous days or token got expired because from previous reset link also the page got opened so, user would not be able to...

Mobile movie app has logic design flaws

Mobile Movie App is a video product specially launched for the majority of movie lovers. There is a logical design vulnerability in the mobile movie app. Attackers can use the vulnerability to perform arbitrary user registration, arbitrary password reset operations...

Ubi smartwatch app has a logic design flaw

The Ubi Smartwatch app is a mobile app that works with your baby's smartwatch. A logical design vulnerability exists in the Ubi Smartwatch app. An attacker can exploit the vulnerability to reset any password...

Hunan Ding Ding Easily Builds App with Multiple Vulnerabilities

Hunan Ding Ding Easily Build APP is an order-taking tool for engineers. Hunan Ding Ding Easy Build APP has arbitrary user registration, payment flaws and arbitrary password reset vulnerability. Attackers can use the vulnerability to register any cell phone number, modify any user order informatio...

Zhengnuo (Shanghai) Energy Conservation Technology Co., Ltd Opler APP has multiple vulnerabilities

Opler APP is a mobile software with a complete backend management system. Zhengnuo Shanghai Energy Conservation Technology Co., Ltd Opler APP exists arbitrary password reset, arbitrary user registration, override and stored cross-site scripting vulnerabilities. Attackers can use the vulnerability...

Fired Up Acting App Has Logic Design Flaws

Fired Up Acting app is an artist booking application launched by Beijing Fired Up Technology Co. There is a logical design vulnerability in the FIRE Performing Arts app. Attackers can use the vulnerability to perform arbitrary user registration, arbitrary password reset operations...

Legal Robot: Password Reset page Session Fixation

After resetting the password the page session gets fixed. Hope that you get it fixed...

Boozt Fashion AB: Password reset token issue

Hi Team, Step to Repro - Request for password reset link. - Go to email and click on password reset link https://www.boozt.com/eu/en/customer/reset-password/c55ae0b6e00e883238d81e9a5a5d9ff1 - Now remove the token and use the link https://www.boozt.com/eu/en/customer/reset-password Observe that ab...

TP-Link Archer C9(UN) Arbitrary Password Reset Vulnerability

TP-Link Archer C9UN is a wireless router product from China P&L TP-LINK. A security vulnerability exists in the passwdrecovery.lua file in the TP-Link Archer C9UN version V2160517. An attacker can exploit the vulnerability to reset the administrator password...

Legal Robot: [Cross-domain Referer leakage] Password reset token leakage via referer

A security researcher discovered that sensitive information, like password reset tokens could still be leaked to analytics services like Google Analytics or via the Referer sic header. Even though tokens were immediately invalidated, we decided to re-engineer the process to eliminate any...

Password Reset And Recovery

pagekit/pagekit is vulnerable to password reset and recovery. Attackers are able to reset a registered user's password when the debug toolbar is enabled. By doing this, attackers are able to recover the password...