EUVD-2025-211255

vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid username can send action=changepassword to RecoverPwd::displayChangePwd and log ...

CVE-2025-71457

The software vtenext versions 25.02 before 25.02.1 is susceptible to an authentication bypass vulnerability located in hub/rpwd.php . The root cause is a lack of token verification within the RecoverPwd::displayChangePwd() function. This allows an unauthenticated attacker who knows a valid user_n...

PT-2026-137123

Name of the Vulnerable Software and Affected Versions vtenext versions 25.02 through 25.02.0 Description An authentication bypass allows unauthenticated attackers to change any account password via the 'hub/rpwd.php' endpoint. By providing a valid user name and sending action=change password to t...