CVE-2021-40101

Survey XSS combined with CSRF leads to Admin Account Takeover in Concrete5 8.5.4 A Concrete CMS admin in versions below 9 did not have to provide their password when changing another user's password. In combination with CVE-2021-28145 "Concrete CMS formerly concrete5 before 8.5.5 allows remote...

CVE-2020-24029

CVE-2020-24029 Description Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can be accessed via a simple request. Important Dates Announcement to Vendor: 2020-07-12 Public disclosure date: 2020-08-31 Vulnerability Type Incorrect...

CVE-2025-22963

Resumen La vulnerabilidad de falsificación de solicitudes entre sitios CSRF en Teedy versiones = v1.11 permite a atacantes remotos obligar a un usuario final a cambiar su información de usuario nombre de usuario, contraseña, etc... en la aplicación web en la que está autenticado actualmente...

CVE-2025-4796

CVE-2025-4796 Eventin Once the email is changed to an attacker-controlled address, the standard WordPress password reset flow can be used to take over the account. 🧰 Script PoC Filename: CVE-2025-4796.py This script automates the steps: 1. Log in to the target WordPress site using supplied...

Azure-AD-Password-Checker

Azure AD Password Checker In an Azure AD environment, it's possible to determine whether a user has Multi-Factor Authentication MFA disabled without requiring any special privileges. This can be accomplished by analyzing the account's creation date and last password change date. If an account's...

AZL-99558 CVE-2026-80786 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fbsetvar in helper Handle fbcon during display updates in fbsetvarfromuser. Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers. On...

CVE-2026-80786

In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fbsetvar in helper Handle fbcon during display updates in fbsetvarfromuser. Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers. On...

CVE-2026-75167

A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts...

CVE-2026-80817

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix NULL pointer deref in iommufdioaschangeprocess when racing with ioptmapfilepages iommufdioaschangeprocess iterates every IOAS area while only holding every IOAS iovarwsem, so it assumes every area has a non-NUL...

CVE-2026-80786

CVE-2026-80786 affects the Linux kernel fbdev (framebuffer) subsystem. The root cause is that user-invoked calls to fb_set_var() from sysfs and driver code paths were missing fbcon -related steps (checking mode-change feasibility, updating hardware state, and updating fbcon). Only the FBIOPUT_VSC...

CVE-2026-80786 fbdev: Wrap user-invoked calls to fb_set_var() in helper

In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fbsetvar in helper Handle fbcon during display updates in fbsetvarfromuser. Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers. On...

CVE-2026-80786 fbdev: Wrap user-invoked calls to fb_set_var() in helper

In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fbsetvar in helper Handle fbcon during display updates in fbsetvarfromuser. Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers. On...

EUVD-2026-71429

In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fbsetvar in helper Handle fbcon during display updates in fbsetvarfromuser. Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers. On...

CVE-2026-85591

phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...

CVE-2026-85591 phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change

phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...

CVE-2026-85591 phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change

phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...

CVE-2026-85591

phpMyFAQ versions before 4.1.8 contain an authentication bypass in the user control panel API endpoint . The root cause is that the password-change handler does not verify the current password before accepting a new one. An attacker with an existing valid session can submit a PUT request to the u...

CVE-2026-84469

A flaw was found in fastify. An unauthenticated remote attacker can bypass request validation by exploiting how fastify processes boolean false schemas. When an application intends to deny all input by assigning 'false' to a route's schema, fastify incorrectly treats it as a missing schema and...

CVE-2023-6654

CVE-2023-6654 PHPEMS Cookie deserialization vulnerability. Exploiting this vulnerability allows modifying SQL statements through deserialization, and through SQL injection, changing the password or permissions of any existing user. The default administrator account is peadmin. Fofa fingerprint...

security_monkey

NOTA: Security Monkey está en modo de mantenimiento y llegará al final de su vida útil en 2020. Para usuarios de AWS, utilice AWS Config. Para usuarios de GCP, utilice Cloud Asset Inventory. Security Monkey Security Monkey supervisa tus cuentas de AWS y GCP en busca de cambios de políticas y aler...