DLLPasswordFilterImplant

DLLPasswordFilterImplant DLLPasswordFilterImplant is a custom password filter DLL that allows the capture of a user's credentials. Each password change event on a domain will trigger the registered DLL in order to exfiltrate the username and new password value prior successfully changing it in th...

Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it...

LatePoint <= 5.0.11 - SQL Injection

The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.11. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-109849

Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user...

CVE-2026-109849

An incorrect privilege assignment issue exists in Hinemos . An attacker with access to the password change API and specific non-administrative permissions can exploit this vulnerability to change the password of an administrative user . No specific exploit details or remediation steps are provide...

CVE-2026-109849

Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user...

EUVD-2026-117201

Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user...

PT-2026-137244

Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user...

EUVD-2025-211255

vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid username can send action=changepassword to RecoverPwd::displayChangePwd and log ...

CVE-2025-71457

The software vtenext versions 25.02 before 25.02.1 is susceptible to an authentication bypass vulnerability located in hub/rpwd.php . The root cause is a lack of token verification within the RecoverPwd::displayChangePwd() function. This allows an unauthenticated attacker who knows a valid user_n...

CVE-2025-71457 vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php

vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid username can send action=changepassword to RecoverPwd::displayChangePwd and log ...

Lotus Domino R5 and R6 WebMail - Information Disclosure

Lotus Domino R5 and R6 WebMail with 'Generate HTML for all fields' enabled which is by default allows remote attackers to read the HTML source to obtain sensitive information including the password hash in the HTTPPassword field, the password change date in the HTTPPasswordChangeDate field, and t...

PT-2026-137303

This module provides a separate page with a form for users to change their own password, which asks for the current password before accepting a new one. The module doesn't sufficiently verify the current password in some cases. This vulnerability is mitigated by the fact that an attacker must...

CVE-2026-110826

Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ashauthentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With applyonpasswordchange? true,...

CVE-2026-110826 AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change

Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ashauthentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With applyonpasswordchange? true,...

CVE-2026-110826 AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change

Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ashauthentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With applyonpasswordchange? true,...

EUVD-2026-116148

Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ashauthentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With applyonpasswordchange? true,...

CVE-2026-110826

The ash_authentication library by team-alembic contains an improper session invalidation vulnerability (CWE-1466). When apply_on_password_change? true is enabled, the AshAuthentication.AddOn.LogOutEverywhere.Transformer fails to revoke stored tokens during non-atomic password changes. This occurs...

SUSE CVE-2026-116251

pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own change password dialog or through an administrator resetting it in User Management. A session established before the change, for example on another device or by someone who had...

CVE-2023-42820

CVE-2023-42820 CVE-2023-42820 Vulnerability Description JumpServer Password Reset Vulnerability USAGE V2 Update 1. Complete refactoring 2. Added default account and email when no account or email is received 3. Improved recognition and calculation of CAPTCHA 4. Automatically modify password 5...