75 matches found
PT-2026-89261
Name of the Vulnerable Software and Affected Versions Bulk Password Reset versions prior to 1.3.4 Description This issue allows authenticated attackers with subscriber-level access and above to perform privilege escalation via account takeover. The flaw exists because the plugin fails to properly...
CVE-2026-18480 SureCart < 4.6.3 - Subscriber+ Administrator Account Takeover
The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...
CVE-2026-18480: Improper Privilege Management
The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...
EUVD-2026-46088
Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified statu...
CVE-2026-27657: Authorization Bypass Through User-Controlled Key
Gitea versions before 1.25.5 allow a user to change another user's primary email address...
PT-2026-39520
OpenCart 3.0.36 contains a cross-site request forgery vulnerability in the /account/edit endpoint that allows unauthenticated attackers to modify victim account details by tricking users into visiting malicious pages. Attackers can craft CSRF payloads that change victim email addresses and accoun...
CVE-2021-41074: Cross-Site Request Forgery (CSRF)
A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document...
CVE-2023-40260
EmpowerID before 7.205.0.1 allows an attacker to bypass an MFA multi factor authentication requirement if the first factor username and password is known, because the first factor is sufficient to change an account's email address, and the product would then send MFA codes to the new email addres...
CVE-2019-20879
An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. Changes to e-mail addresses do not require credential re-entry...
CVE-2019-20875
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows a password reset to proceed while an e-mail address is being changed...
CVE-2025-1313
The Nokri - Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email address. This makes it...
The vulnerability of the monitoring and analysis software in Nagios Log Server’s IT infrastructure lies in the improper storage of permissions. This allows a hacker to bypass existing security restrictions and gain increased privileges.
The vulnerability of the Nagios Log Server software for monitoring and analyzing log files is related to the improper storage of permissions during the process of changing the email address of the user account. Exploiting this vulnerability allows a malicious actor to bypass existing security...
CVE-2025-48986: Improper Access Control
Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality...
CVE-2025-64349 ELOG user profile missing authorization
ELOG allows an authenticated user to modify another user's profile. An attacker can edit a target user's email address, then request a password reset, and take control of the target account. By default, ELOG is not configured to allow self-registration...
EUVD-2019-13407
Malware in sbrugna...
EUVD-2019-8361
Malware in sbrugna...
EUVD-2014-5403
Malware in sbrugna...
EUVD-2023-40118
Malicious code in bioql PyPI...