CVE-2025-63800

The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation. When an authenticated user omits or leaves the password and repeatpassword parameters empty in the password change request, the...

CVE-2025-55796

The openml/openml.org web application version v2.0.20241110 uses predictable MD5-based tokens for critical user workflows such as signup confirmation, password resets, email confirmation resends, and email change confirmation. These tokens are generated by hashing the current timestamp formatted ...

CVE-2025-63800

Open Source Point of Sale version 3.4.1 is vulnerable to a weak password requirement flaw in its password change endpoint . Due to a lack of server-side validation , an authenticated user can omit or leave the password and repeat_password parameters empty. The backend processes these requests suc...

GO-2025-4127 Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos...

EUVD-2024-55087

PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the oldpass parameter in change-password.php...

CVE-2024-44641

PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the oldpass parameter in change-password.php...

CVE-2024-44641

PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the oldpass parameter in change-password.php...

CVE-2024-21635

Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access. When a user changes their password, the existing list of Access Tokens stay valid instead of expiring. If a user finds that their account has been compromised, they can update the...

CVE-2024-44641: Improper Neutralization of Special Elements used in an SQL Command

PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the oldpass parameter in change-password.php...

PT-2025-47157

Name of the Vulnerable Software and Affected Versions QaTraq version 6.9.2 Description QaTraq version 6.9.2 is shipped with default administrative account credentials enabled, allowing immediate login via the web application login page. An attacker reaching the login page can gain administrative...

CVE-2024-44641

PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the oldpass parameter in change-password.php...

CVE-2024-44641

PHPGurukul Small CRM version 3.0 is vulnerable to a SQL Injection flaw within the change-password.php file. The root cause is a lack of proper validation for externally entered SQL statements provided via the oldpass parameter. An attacker could exploit this vulnerability to execute illegal SQL c...

PT-2025-47161

Name of the Vulnerable Software and Affected Versions PHPGurukul Small CRM version 3.0 Description PHPGurukul Small CRM version 3.0 contains a SQL Injection flaw. This issue affects the change-password.php file through the oldpass parameter. The flaw could allow an attacker to inject malicious SQ...

CVE-2024-44641

PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the oldpass parameter in change-password.php...

PHPGurukul Small CRM 安全漏洞

Small CRM a customer relationship management system. Small CRM suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the oldpass parameter of change-password.php. This vulnerability can be exploited by an attacker to execute...

CVE-2024-44633

PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the currentpassword parameter in change-password.php...

Human-Centered Threat Modeling in Practice: Lessons, Challenges, and Paths Forward

Human-centered threat modeling HCTM is an emerging area within security and privacy research that focuses on how people define and navigate threats in various social, cultural, and technological contexts. While researchers increasingly approach threat modeling from a human-centered perspective,...

Memos' Access Tokens Stay Valid after User Password Change

Summary Access Tokens are used to authenticate application access. When a user changes their password, the existing list of Access Tokens stay valid instead of expiring. If a user finds that their account has been compromised, they can update their password. The bad actor though will still have...

GHSA-MR34-8733-GRR2 Memos' Access Tokens Stay Valid after User Password Change

Summary Access Tokens are used to authenticate application access. When a user changes their password, the existing list of Access Tokens stay valid instead of expiring. If a user finds that their account has been compromised, they can update their password. The bad actor though will still have...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration due to the failure to revoke access tokens after a password change. An attacker can maintain unauthorized access to a user's account by continuing to use a previously issued access token even after the...