CVE-2026-41931

Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can access the admin password-reset endpoint to trigger a fatal err...

CVE-2026-41931 Vvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler

Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can access the admin password-reset endpoint to trigger a fatal err...

EUVD-2026-27887

Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can access the admin password-reset endpoint to trigger a fatal err...

CVE-2026-41931: Initialization of a Resource with an Insecure Default

Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can access the admin password-reset endpoint to trigger a fatal err...

CVE-2026-21622 Password Reset Tokens Do Not Expire

Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm 'Elixir.Hexpm.Accounts.PasswordReset' module allows Account Takeover. Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset, Hex sends an email containing a reset...

CVE-2020-10966

In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name...

CVE-2025-2910

CVE-2025-2910 concerns MeetMe, specifically the authentication service's password reset module. The vulnerability enables user enumeration by responding with distinct error messages that reveal whether an email address is registered, affecting versions prior to 2024-09. Affected software/componen...

CVE-2025-2910 User enumeration vulnerability in MeetMe products

User enumeration in the password reset module of the MeetMe authentication service in versions prior to 2024-09 allows an attacker to determine whether an email address is registered through specific error messages...

CVE-2025-2910: Observable Response Discrepancy

User enumeration in the password reset module of the MeetMe authentication service in versions prior to 2024-09 allows an attacker to determine whether an email address is registered through specific error messages...

PT-2025-13514

Name of the Vulnerable Software and Affected Versions MeetMe versions prior to 2024-09 Description The issue concerns user enumeration in the password reset module of the MeetMe authentication service. This allows an attacker to determine whether an email address is registered through specific...

PT-2020-16688

Name of the Vulnerable Software and Affected Versions Anuko Time Tracker version 1.19.23.5311 Description The issue is related to a lack of rate limit on the password reset module, which allows an attacker to perform a Denial of Service attack on any legitimate user's mailbox. Recommendations For...

CVE-2020-27423: Improper Restriction of Excessive Authentication Attempts

Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox...

PT-2020-13841

Name of the Vulnerable Software and Affected Versions Navigate CMS version 2.9 r1433 Description An issue was discovered that allows unauthorized users to reset passwords without a valid activation code. When no activation code is supplied during a password reset, the system permits the user to...

CVE-2020-10966

In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name...

Design/Logic Flaw

In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name...

CVE-2020-10966

In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name...

CVE-2020-10966

In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name...

CVE-2020-10966

Summary (CVE-2020-10966): The vulnerability affects Vesta Control Panel and Hestia Control Panel Password Reset Module. Through versions VestaCP up to 0.9.8-25 (and Hestia up to 1.1.1), an attacker can manipulate the Host header to cause an account takeover, as the reset URL delivered to the vict...

CVE-2020-10966: Undefined Security Weakness

In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name...

PT-2020-12454

Name of the Vulnerable Software and Affected Versions VESTA Control Panel versions 0.9.8-25 and earlier Hestia Control Panel versions prior to 1.1.1 Description The issue allows for account takeover through Host header manipulation in the Password Reset Module. This occurs because the victim...