SUSE CVE-2026-18638

Any authenticated Velociraptor user - including one holding only the readerrole - can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...

CVE-2026-18638

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...

CVE-2026-18638 Velociraptor server crash via the SetPassword API

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...

CVE-2026-18638 Velociraptor server crash via the SetPassword API

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...

CVE-2026-18638

CVE-2026-18638 : Velociraptor server can be terminated by any authenticated user (even reader role) via SetPassword with a non-existent username, potentially crashing the entire server. Documented impact is server process termination (availability impact: High). No remediation or patch details ar...

EUVD-2026-56185

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...

CVE-2026-18638 Velociraptor server crash via the SetPassword API

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...

PT-2026-70234

Name of the Vulnerable Software and Affected Versions Velociraptor affected versions not specified Description Any authenticated user, including those with the reader role, can cause the entire server process to terminate by sending a single request. This occurs when calling the SetPassword...

CVE-2026-18638: NULL Pointer Dereference

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...

CVE-2026-33297

WWBN AVideo is an open source video platform. Prior to version 26.0, the setPassword.json.php endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numer...

WWBN AVideo 安全漏洞

WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 26.0 contained security vulnerabilities. These vulnerabilities stemmed from a logical error in the setPassword.json.php endpoint of the CustomizeUser plugin. This error could cau...

AVideo: IDOR - Any Admin Can Set Another User's Channel Password Via SetPassword.json.php

Summary The "setPassword.json.php" endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numeric characters is silently coerced to the integer zero befor...

CVE-2013-6852

Cross-site request forgery CSRF vulnerability in html/json.html on HP 2620 switches allows remote attackers to hijack the authentication of administrators for requests that change an administrative password via the setPassword method...

Exploit for Improper Check for Unusual or Exceptional Conditions in Polkit_Project Polkit

CVE-2021-3560 is an authenticatio...

Cross-Site Request Forgery (CSRF)

github.com/casdoor/casdoor is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists in the SetPassword function at user.go due to a lack of CSRF token, which allows an attacker to change a users password...

Exploit for Incorrect Authorization in Polkit_Project Polkit

polkit-auto-exploit Automatic Explotation PoC for Polkit CVE-2...

GHSA-WVH7-5P38-2QFC Storing Password in Local Storage

The setPassword method http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.htmlsetPassword stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time that password is stored at all. In the...

PT-2020-21570

Name of the Vulnerable Software and Affected Versions Parse SDK versions 2.9.1 Parse Server versions 3.9.0 Description The issue arises from the setPassword method, which stores a user's password in localStorage as raw text, making it accessible to anyone with access to the localStorage. This...

uniForum <= 4 - (wbsearch.aspx) Remote SQL Injection Vulnerability

No description provided by source. Title : uniForum = v4 wbsearch.aspx Remote SQL Injection Vulnerability Author : ajann Contact : : S.Page : ... Vendor : http://uniforum.biz/ $$ : $99 SQL--------------------------------------------------------- http://target/path//wbsearch.aspx POST Method SQL...

CVE-2013-6852: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in html/json.html on HP 2620 switches allows remote attackers to hijack the authentication of administrators for requests that change an administrative password via the setPassword method...