EUVD-2025-25601

Malicious code in bioql PyPI...

EUVD-2025-27262

Malicious code in bioql PyPI...

EUVD-2025-10872

Malicious code in bioql PyPI...

EUVD-2025-31655

Malicious code in bioql PyPI...

Polska Akademia Dostępności CMS 安全漏洞

Polska Akademia Dostępności CMS is an accessible web content management system from Polska Akademia Dostępności, Poland. A security vulnerability exists in Polska Akademia Dostępności CMS that stems from improper initialization of password recovery parameters, which could lead to arbitrary user...

The vulnerability of Sophos AP6 wireless access points lies in the lack of necessary verification when changing passwords. This allows attackers to gain access to the device’s control IP address and enhance their privileges.

The vulnerability of the microprogrammed software of Sophos AP6 wireless access points is related to the lack of necessary checks during password changes. Exploiting this vulnerability can allow a malicious actor to gain access to the control IP address of the device and enhance their privileges...

CubeCart 安全漏洞

CubeCart is an e-commerce software from CubeCart Open Source. A security vulnerability exists in CubeCart versions prior to 6.5.11, which stems from a password change that does not automatically expire the session, which could cause an unauthorized user to maintain access...

CVE-2025-57766

Fides is an open-source privacy engineering platform. Prior to version 2.69.1, admin UI user password changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity where attackers who have obtained session tokens through other attack vectors such as XSS ca...

Linux Distros Unpatched Vulnerability : CVE-2016-7038

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed. CVE-2016-7038 Note that Nessus relies o...

CVE-2025-9114

CVE-2025-9114 affects the Doccure WordPress theme. Versions up to and including 1.4.8 are vulnerable due to user-controlled access to objects that bypasses authorization, enabling unauthenticated attackers to change user passwords and potentially take over administrator accounts. The issue has a ...

WordPress plugin Doccure 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2025-5931

The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.5. This is due to the plugin not properly validating a user's identity prior to updating their password during a staff password reset. This makes it possible for...

CVE-2025-5931 Dokan Pro <= 4.0.5 - Authenticated (Vendor+) Privilege Escalation

The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.5. This is due to the plugin not properly validating a user's identity prior to updating their password during a staff password reset. This makes it possible for...

Linux Distros Unpatched Vulnerability : CVE-2019-3467

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian-edu-config all versions 2.11.10, a set of configuration files used for Debian Edu, and debian- lan-config 0.26, configured too permissive ACLs for the...

Linux Distros Unpatched Vulnerability : CVE-2016-10206

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site request forgery CSRF vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that...

CVE-2025-55629

Insecure permissions in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.46622503122283 allow attackers to arbitrarily change other users' passwords via manipulation of the userName value...

CVE-2025-55629

Insecure permissions in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.46622503122283 allow attackers to arbitrarily change other users' passwords via manipulation of the userName value...

Brute Force

Overview vantage6-server is a Vantage6 server Affected versions of this package are vulnerable to Brute Force due to a lack of rate limiting on the password change functionality. An attacker who has gained access to an authenticated session can attempt to brute-force the user's password. They can...

vantage6 安全漏洞

vantage6 is a vantage6 open source priVAcy preserviNg federalTed leArningG infrastructure for Secure Insight eXchange. A security vulnerability exists in vantage6 versions prior to 4.11 that stems from the change password feature allowing unlimited attempts, which could lead to a brute force atta...

The vulnerability of the DataHandler module and the Setup Module of the TYPO3 content management system allows attackers to bypass security restrictions and gain unauthorized access to protected information.

The vulnerability of the DataHandler module and the Setup Module in the TYPO3 content management system is related to the lack of necessary checks during password changes. Exploiting this vulnerability allows an attacker to bypass security restrictions and gain unauthorized access to protected...