CVE-2025-15398

Uasoft Badaso up to version 2.9.7 has a weakness in the forgetPassword path of the Token Handler (src/Controllers/BadasoAuthController.php). The vulnerability, described as a remote‑executable weakness in password recovery, arises from the forgetPassword function and is characterized by high atta...

CVE-2025-15398: Weak Password Recovery Mechanism for Forgotten Password

A security vulnerability has been detected in Uasoft badaso up to 2.9.7. Affected is the function forgetPassword of the file src/Controllers/BadasoAuthController.php of the component Token Handler. Such manipulation leads to weak password recovery. The attack can be executed remotely. This attack...

CVE-2025-53373

Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the /forgetpassword endpoint. This vulnerability is fixed with commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b...

CVE-2025-53373: Weak Password Recovery Mechanism for Forgotten Password

Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the /forgetpassword endpoint. This vulnerability is fixed with commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b...

CVE-2021-43451

SQL Injection vulnerability exists in PHPGURUKUL Employee Record Management System 1.2 via the Email POST parameter in /forgetpassword.php...

Phpgurukul Employee Record Management System SQL注入漏洞

Employee Record Management System is an employee record management system. Employee Record Management System has a SQL injection vulnerability that originates from a SQL injection vulnerability in the Email POST parameter via /forgetpassword.php, no detailed vulnerability details are available at...

PT-2021-23848 · Unknown · Phpgurukul Employee Record Management System

Name of the Vulnerable Software and Affected Versions: PHPGURUKUL Employee Record Management System version 1.2 Description: A SQL Injection issue exists via the Email POST parameter in the "/forgetpassword.php" API endpoint. This allows for potential exploitation. Recommendations: For PHPGURUKUL...