Flowise <= 3.0.5 - Account Takeover

Flowise versions 3.0.5 and earlier had a vulnerability in the forgot-password endpoint, which returned valid reset tokens without authentication—allowing attackers to reset passwords and take over accounts. id: CVE-2025-58434 info: name: Flowise = 3.0.5 - Account Takeover author:...

CVE-2025-2304

Camaleon CMS -p Argumentos -t, --target URL base del objetivo -u, --username Nombre de usuario válido con pocos privilegios -p, --password Contraseña del usuario Flujo del Exploit 1. Obtener la página de inicio de sesión y extraer el token CSRF 2. Autenticarse con las credenciales proporcionadas ...

CVE-2023-7028

CVE-2023-7028 Exploit - Vulnerabilidad de Envenenamiento de Restablecimiento de Contraseña de GitLab Descripción general Este repositorio contiene un exploit para CVE-2023-7028 , una vulnerabilidad crítica en GitLab que permite a un atacante abusar de la funcionalidad de restablecimiento de...

CVE-2025-58434-Unauthenticated-Password-Reset-Flowwise

Toma de Control de Cuenta por Restablecimiento de Contraseña de Flowise ATO Solo para fines de investigación y pruebas! No soy responsable de ningún daño a infraestructura en vivo si esta herramienta no se utiliza según lo previsto. Úsela solo en sistemas que posea o tenga permiso para probar! Us...

csrf_casdoor

Casdoor – 跨站请求伪造（CSRF） 摘要 漏洞：/api/set-password 中的 CSRF，允许未经用户同意修改密码。 受影响版本：软件的所有版本均受影响。目前没有可用的已修补版本。 CVE：CVE-2023-34927（最新的 CVE 尚未分配）。 漏洞利用作者：Van Lam Nguyen。 测试平台：Windows 影响 如果受害者已登录 Casdoor，跨站 POST 可以更改受害者的密码（例如 built-in/admin），从而导致账户接管。 攻击前提条件 受害者已通过身份验证，并拥有有效的 casdoorsessionid Cookie。...

Metabase-Exploit

Metabase SQL Injection Zero-Day Exploit GHSA-vwf4-m7j8-wcjf...

SUSE CVE-2026-55077

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the PUT /api/v2/users/user/password endpoint authorized only ActionUpdatePersonal and did not prevent a user-admin from resetting an owner account's passwor...

PT-2026-62101

djangoSIGE through 1.10 commit a6fe7e8 contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can...

CVE-2026-61451

The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...

CVE-2026-61451 Grav before 1.0.4 Password Reset Token Poisoning via admin_base_url

The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...

CVE-2026-15479

A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function changepasswd of the file /api/login/modify of the component Administrator Password Modification Endpoint. The manipulation of the argument newPass results in weak password recovery. The attack may be...

EUVD-2026-43201

A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function changepasswd of the file /api/login/modify of the component Administrator Password Modification Endpoint. The manipulation of the argument newPass results in weak password recovery. The attack may be...

CVE-2026-15479

The vulnerability CVE-2026-15479 affects H3C NX15 V100R017. The vulnerable component is the Administrator Password Modification Endpoint, specifically the change_passwd function at /api/login/modify. Manipulating the newPass parameter results in weak password recovery. The issue can be exploited ...

EUVD-2026-43100

Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the resetpassword endpoint. This issue is fixed in versions 16.16.0 and 15.106.0...

PT-2026-57334

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 16.16.0 Frappe versions prior to 15.106.0 Description User enumeration is possible through the 'reset password' endpoint. User enumeration is a technique used to verify if a specific user exists within a system by...

CVE-2026-14701

A vulnerability was detected in code-projects Internship Management System 1.0. This affects an unknown function of the file employer/details/changepassword.php of the component Password Change Endpoint. The manipulation of the argument Current results in sql injection. The attack can be executed...

EUVD-2026-41720

A vulnerability was detected in code-projects Internship Management System 1.0. This affects an unknown function of the file employer/details/changepassword.php of the component Password Change Endpoint. The manipulation of the argument Current results in sql injection. The attack can be executed...

PT-2026-55762

A vulnerability was detected in code-projects Internship Management System 1.0. This affects an unknown function of the file employer/details/change password.php of the component Password Change Endpoint. The manipulation of the argument Current results in sql injection. The attack can be execute...

CVE-2026-56780

Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/pk/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to reset superadmin...

EUVD-2026-40155

Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/pk/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to reset superadmin...