37369 matches found
CVE-2026-85591
phpMyFAQ versions before 4.1.8 contain an authentication bypass in the user control panel API endpoint . The root cause is that the password-change handler does not verify the current password before accepting a new one. An attacker with an existing valid session can submit a PUT request to the u...
CVE-2026-85591 phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change
phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...
CVE-2026-84469
A flaw was found in fastify. An unauthenticated remote attacker can bypass request validation by exploiting how fastify processes boolean false schemas. When an application intends to deny all input by assigning 'false' to a route's schema, fastify incorrectly treats it as a missing schema and...
CVE-2026-80786: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fbsetvar in helper Handle fbcon during display updates in fbsetvarfromuser. Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers. On...
PT-2026-85491
phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...
PT-2026-85627
In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fb set var in helper Handle fbcon during display updates in fb set var from user. Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all...
CVE-2026-75167
The MBS-Solutions X-Serie Gateway running firmware V6_00_05 is vulnerable to a broken access control flaw in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi . This vulnerability allows a remote authenticated user with a low-privileged Standard role to change the password of arbitrary accounts. No ...
Linux Distros Unpatched Vulnerability : CVE-2026-80786
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: Wrap user-invoked calls to fbsetvar in helper Handle fbcon during display updates in fbsetvarfromuser. Check with fbcon if the mode change is possible,...
CVE-2026-84504: Improper Input Validation
fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that...
CVE-2026-85591: Unverified Password Change
phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...
EUVD-2026-71446
A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts...
CVE-2026-75167
A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts...
PT-2026-85682
A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6 00 05 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts...
CVE-2026-75167: Improper Access Control
A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts...
CVE-2026-75167
A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts...
GHSA-8CJ9-R88M-8945 Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation
Summary The password change form is vulnerable to CSRF, allowing an attacker to change a user password even the administrator by tricking a connected user to visit a malicious website. The vulnerability has been tested with version 2.18.20. Details The password change endpoint of Semaphore UI doe...
EUVD-2026-57311
Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation...
Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation
Summary The password change form is vulnerable to CSRF, allowing an attacker to change a user password even the administrator by tricking a connected user to visit a malicious website. The vulnerability has been tested with version 2.18.20. Details The password change endpoint of Semaphore UI doe...
