EUVD-2025-206105

A security vulnerability has been detected in Uasoft badaso up to 2.9.7. Affected is the function forgetPassword of the file src/Controllers/BadasoAuthController.php of the component Token Handler. Such manipulation leads to weak password recovery. The attack can be executed remotely. This attack...

CVE-2025-15398

Uasoft Badaso up to version 2.9.7 has a weakness in the forgetPassword path of the Token Handler (src/Controllers/BadasoAuthController.php). The vulnerability, described as a remote‑executable weakness in password recovery, arises from the forgetPassword function and is characterized by high atta...

Arbitrary Code Execution

badaso/core is vulnerable to arbitrary code executions. The vulnerability exists because the construct function of BadasoAuthController.php does not properly validate the data uploaded by the users, allowing an attacker to inject and execute malicious commands...