Branda WordPress plugin - Privilege Escalation

Branda WordPress plugin = 3.4.24 contains a privilege escalation caused by improper user identity validation in password update functionality, letting unauthenticated attackers change arbitrary user passwords, including administrators, exploit requires crafted request. id: CVE-2025-14998 info:...

Blackash-CVE-2025-4322

CVE-2025-4322 : 認証されていないパスワード更新による権限昇格「アカウント乗っ取り 🔥」 説明 : Motors WordPressテーマは、バージョン5.6.67まで（同バージョンを含む）のすべてのバージョンにおいて、アカウント乗っ取りによる権限昇格の脆弱性があります。これは、テーマがパスワード更新前にユーザーの身元を適切に検証しないことに起因します。このため、認証されていない攻撃者が、管理者を含む任意のユーザーのパスワードを変更し、それを利用してアカウントにアクセスすることが可能になります。 メトリクス : CNA: Wordfence 基本スコア: 9.8 ⚫...

CVE-2026-49060-Lab

CVE-2026-49060 - Hippoo Mobile App for WooCommerce の不正確な権限割り当て / 権限昇格 エグゼクティブサマリー このリポジトリには、WordPressプラグイン Hippoo Mobile App for WooCommerce に影響を及ぼす不正確な権限割り当ての脆弱性 CVE-2026-49060 を再現・検証するためのローカル Docker ラボが含まれています。 脆弱な動作は、Hippoo の複製された REST API 名前空間を通じて公開されます：text /wc-hippoo/v1/ext/ root@kitploit: ...

CVE-2026-90499

A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Password Update Handler. The manipulation of the argument hrid results in improper authorization. The attack can be executed remotely. The...

EUVD-2026-76971

A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Password Update Handler. The manipulation of the argument hrid results in improper authorization. The attack can be executed remotely. The...

CVE-2026-90499

A vulnerability in lenve vhr 1.0-SNAPSHOT affects the Password Update Handler component, specifically the HrInfoController.updatePass function in the /hr/pass file. The root cause is improper authorization resulting from manipulation of the hrid argument, allowing a remote attacker with low privi...

WordPress Booking for Appointments and Events Calendar plugin 9.0-9.7 - Provider+ Arbitrary Provider Password Update vulnerability

Provider+ Arbitrary Provider Password Update vulnerability discovered by Haitam Lazaar in WordPress Plugin Amelia versions 9.0-9.7...

CVE-2026-81031

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

EUVD-2026-66607

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

CVE-2026-81031

CVE-2026-81031 affects IDURAR ERP CRM through version 4.1.1 . The vulnerability resides in the password update handler (updatePassword.js), which applies a password change to the identifier in the URL path rather than verifying it matches the authenticated user. Because the route requires only a ...

CVE-2026-81031 IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

CVE-2026-81031 IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

CVE-2026-81031 IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

CVE-2025-10005

The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppwfreesetpassword AJAX action due to missing validation on a user controlled key. This makes it...

CVE-2025-67405

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in updatepassword.php via the parameter newpassword...

CVE-2026-35676 phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint

phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force immediate password changes by sendin...

EUVD-2026-32905

phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force immediate password changes by sendin...

CVE-2026-35676

phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force immediate password changes by sendin...

PT-2026-44385

phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force immediate password changes by sendin...

Weak Password Recovery Mechanism for Forgotten Password

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password via the updatePassword process. An attacker can gain unauthorized access to any user account,...