CVE-2026-92915 WWBN AVideo userVerifyEmail.php Unauthenticated Access Control

WWBN AVideo through commit e01e41ecc no patched version available contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement $global'ignoreUserMustBeLoggedIn' = 1, takes usersid directly from the query string, and calls User::sendVerificationLi...

EUVD-2026-81437

WWBN AVideo through commit e01e41ecc no patched version available contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement $global'ignoreUserMustBeLoggedIn' = 1, takes usersid directly from the query string, and calls User::sendVerificationLi...

CVE-2026-92915 WWBN AVideo userVerifyEmail.php Unauthenticated Access Control

WWBN AVideo through commit e01e41ecc no patched version available contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement $global'ignoreUserMustBeLoggedIn' = 1, takes usersid directly from the query string, and calls User::sendVerificationLi...

CVE-2025-62294 Predictable Generation of Password Recovery Token

SOPlanning is vulnerable to Predictable Generation of Password Recovery Token. Due to weak mechanism of generating recovery tokens, a malicious attacker is able to brute-force all possible values and takeover any account in reasonable amount of time. This issue was fixed in version 1.55...

EUVD-2025-198310

SOPlanning is vulnerable to Predictable Generation of Password Recovery Token. Due to weak mechanism of generating recovery tokens, a malicious attacker is able to brute-force all possible values and takeover any account in reasonable amount of time. This issue was fixed in version 1.55...

CVE-2025-62294: Generation of Predictable Numbers or Identifiers

SOPlanning is vulnerable to Predictable Generation of Password Recovery Token. Due to weak mechanism of generating recovery tokens, a malicious attacker is able to brute-force all possible values and takeover any account in reasonable amount of time. This issue was fixed in version 1.55...

EUVD-2020-17796

Malware in sbrugna...

EUVD-2019-15028

Malware in sbrugna...

CVE-2020-25105

eramba c2.8.1 and Enterprise before e2.19.3 has a weak password recovery token createHash has only a million possibilities...

Lunary Information Disclosure Vulnerability

lunary is a production toolkit for LLM. An information disclosure vulnerability exists in lunary that stems from exposing a password recovery token in an API response. An attacker could exploit this vulnerability to cause an information disclosure...

Lunary 信息泄露漏洞

lunary is a production toolkit for LLM. An information disclosure vulnerability exists in lunary that stems from exposing a password recovery token in an API response. An attacker could exploit this vulnerability to cause an information disclosure...

CVE-2020-25105

eramba c2.8.1 and Enterprise before e2.19.3 expose a weak password recovery token: createHash has only ~1,000,000 possibilities, enabling guessable token recovery. CVSS vectors show MEDIUM (2.0) and CRITICAL (3.1) with HIGH impact to confidentiality, integrity, and availability; no remediation de...

PT-2020-15947

Name of the Vulnerable Software and Affected Versions eramba versions c2.8.1 and earlier, eramba Enterprise versions prior to e2.19.3 Description The issue is related to a weak password recovery token. Specifically, the createHash function has only a million possibilities, which is considered...

CVE-2017-5521

An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote...