CVE-2025-58434-PoC

CVE-2025-58434 PoC Python proof-of-concept script for triggering POST /api/v1/account/forgot-password. ⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal. Credit zaddy6 Isaac David arthurgervais...

Flowise <= 3.0.5 - Account Takeover

Flowise versions 3.0.5 and earlier had a vulnerability in the forgot-password endpoint, which returned valid reset tokens without authentication—allowing attackers to reset passwords and take over accounts. id: CVE-2025-58434 info: name: Flowise = 3.0.5 - Account Takeover author:...

CVE-2025-58434-59528

CVE-2025-58434 + CVE-2025-59528 Exploit chain for two vulnerabilities affecting Flowise = 3.0.5. Vulnerabilities CVE-2025-58434 — Unauthenticated Account Takeover The forgot-password endpoint returns a valid password reset token in the API response without requiring authentication. An attacker wi...

holehe

Holehe OSINT - Электронная почта к зарегистрированным аккаунтам 👋 Всем привет! По вопросам профессионального сотрудничества обращайтесь ко мне по адресу: [email protected] 📧 Пожалуйста, используйте для переписки свою рабочую почту. Будем краткими и по делу, и всё на английском! Онлайн-версия...

CVE-2026-31283

CVE-2026-31283 Beschreibung Die Funktion 'Passwort vergessen' kann genutzt werden, um einen E-Mail-Bombing-Angriff auf die E-Mail eines Opfers zu starten. CVSS 3 Score: 7.5 Hoch Angriffstyp Remote Nicht authentifiziert Betroffene Versionen Versionen vor 19.1.5 Entdeckt von: Yazan Abu-Nadi...

CVE-2025-46047

CVE-2025-46047 Silverpeas = 6.4.2 Benutzernamen-Enumeration – PoC Proof-of-Concept-Skript zur Demonstration einer Benutzernamen-Enumeration-Schwachstelle in Silverpeas Versionen 6.4.1 und 6.4.2. Details zur Schwachstelle Betroffene Software: Silverpeas Betroffene Versionen: 6.4.1, 6.4.2 und...

CVE-2024-34582

CVE-2024-34582 Interessa le versioni più recenti dei browser web Mozilla e Chrome, e i dispositivi Sunhillo Rici5k e Sureline Le versioni più recenti dei server web in esecuzione sui dispositivi Sunhillo sono suscettibili a XSS riflesso. La vulnerabilità risiede nel parametro useridchange...

CVE-2024-9441

CVE-2024-9441 Descrizione della vulnerabilità: Questo codice sfrutta una vulnerabilità di Remote Code Execution RCE causata da una sanitizzazione inadeguata dell'input in un'applicazione web basata su PHP. La debolezza specifica si trova nella funzionalità "forgot password"...

CVE-2025-58434-Unauthenticated-Password-Reset-Flowwise

Flowise Passwort-Reset Account-Übernahme ATO Nur für Forschungs- und Testzwecke! Ich übernehme keine Haftung für Schäden an Live-Infrastrukturen, wenn dieses Tool nicht bestimmungsgemäß verwendet wird. Verwenden Sie es nur auf Systemen, die Ihnen gehören oder für die Sie eine Testberechtigung...

CVE-2025-58434_CVE-2025-59528

CVE-2025-58434CVE-2025-59528 Script PoC CVE-2025-58434 Flowise -lp...

CVE-2026-81033

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account...

EUVD-2026-66609

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account...

CVE-2026-81033 Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account...

CVE-2026-81033

Automatisch (through v0.15.0 ) exposes a user enumeration vulnerability through its forgot-password endpoint. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js returns a not-found status for unregistered addresses but a no-content status for registered on...

CVE-2026-81033 Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account...

PT-2026-82221

Name of the Vulnerable Software and Affected Versions Automatisch affected versions not specified Description An information disclosure issue exists in the forgot-password functionality. The endpoint '/api/v1/users/forgot-password' allows an unauthenticated user to determine if a specific address...

POC-CVE-2026-18963

CVE-2026-18963 — PoC zur Umgehung der Authentifizierung im „Passwort vergessen“-Ablauf von Keycloak Proof of Concept für CVE-2026-18963 , eine Schwachstelle im „Passwort vergessen“-/ Anmeldedaten-Auswahl-Ablauf von Keycloak, die es einem Angreifer ermöglicht, den Schritt UPDATEPASSWORD zu erreich...

CVE-2026-64635

Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to...

EUVD-2026-51018

Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to...

CVE-2026-64635

Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to...