CVE-2026-93340

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation...

CVE-2026-93340 Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation...

CVE-2026-93340 Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation...

CVE-2026-93340

Gladys Assistant before version 5.1.0 is affected by a password reset link poisoning vulnerability in the forgot_password endpoint. The root cause is the server's acceptance of a client-supplied origin parameter without validation , allowing an unauthenticated remote attacker to craft a request w...

CVE-2026-93340 Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation...

CVE-2026-93340: Weak Password Recovery Mechanism for Forgotten Password

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation...

EUVD-2023-3182

Malicious code in bioql PyPI...

EUVD-2023-47675

Malicious code in bioql PyPI...

CVE-2024-47210

Gladys Assistant before 4.45.1 allows Privilege Escalation a user changing their own role because req.body.role can be used in updateMySelf in server/api/controllers/user.controller.js...

CVE-2023-43256

A path traversal in Gladys Assistant v4.26.1 and below allows authenticated attackers to extract sensitive files in the host machine by exploiting a non-sanitized user input...

CVE-2023-47440

Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal. The patch of CVE-2023-43256 was found to be incomplete, allowing authenticated attackers to extract sensitive files in the host machine...

CVE-2024-47210

Gladys Assistant before 4.45.1 allows Privilege Escalation a user changing their own role because req.body.role can be used in updateMySelf in server/api/controllers/user.controller.js...

CVE-2024-47210: Uncontrolled Resource Consumption

Gladys Assistant before 4.45.1 allows Privilege Escalation a user changing their own role because req.body.role can be used in updateMySelf in server/api/controllers/user.controller.js...

Gladys Assistant 安全漏洞

Gladys Assistant is a source home assistant software from Gladys Assistant open source. A security vulnerability exists in Gladys Assistant versions prior to 4.45.1 that stems from allowing elevation of privilege...

CVE-2024-47210

Gladys Assistant before 4.45.1 allows Privilege Escalation a user changing their own role because req.body.role can be used in updateMySelf in server/api/controllers/user.controller.js...

CVE-2024-47210

Gladys Assistant before 4.45.1 allows Privilege Escalation a user changing their own role because req.body.role can be used in updateMySelf in server/api/controllers/user.controller.js...

CVE-2024-47210

Gladys Assistant before 4.45.1 allows Privilege Escalation a user changing their own role because req.body.role can be used in updateMySelf in server/api/controllers/user.controller.js...

CVE-2024-47210

Gladys Assistant versions prior to 4.45.1 are vulnerable to Privilege Escalation due to an improper input validation flaw. Specifically, the updateMySelf function in server/api/controllers/user.controller.js allows a user to change their own role because req.body.role can be processed by the appl...

Directory Traversal in Gladys Assistant

Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal. The patch of CVE-2023-43256 was found to be incomplete, allowing authenticated attackers to extract sensitive files in the host machine...

GHSA-C79F-PQGF-FHP3 Directory Traversal in Gladys Assistant

Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal. The patch of CVE-2023-43256 was found to be incomplete, allowing authenticated attackers to extract sensitive files in the host machine...