EUVD-2025-13659

Malicious code in bioql PyPI...

PT-2025-39957

Name of the Vulnerable Software and Affected Versions LatePoint plugin for WordPress versions through 5.1.94 Description The software is susceptible to Cross-Site Request Forgery due to the absence of nonce validation. This occurs on the change password function within the customer cabinet change...

CVE-2025-58434

Flowise was vulnerable in versions up to 3.0.5 where the forgot-password API returned a valid tempToken and other sensitive user data without authentication, enabling an unauthenticated attacker to reset passwords and take over accounts (including admins). A fix was released in version 3.0.6 that...

CVE-2025-58065

CVE-2025-58065 (Flask-AppBuilder) : Prior to v4.8.1, when using non-database authentication (OAuth/LDAP, etc.), the password reset endpoint remains registered and accessible even if not shown in the UI. This can let an enabled user reset their password and obtain JWTs, potentially bypassing deact...

CVE-2025-52395

An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to validate the identity of the requester properly...

CVE-2025-52395

An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to validate the identity of the requester properly...

CVE-2025-52395

An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to validate the identity of the requester properly...

Roadcube API 安全漏洞

Roadcube API is a management interface software from Roadcube Greece. A security vulnerability exists in the Roadcube API v.1 version that stems from a password reset API endpoint that does not validate the identity of the requester, which could lead to the execution of arbitrary code...

PT-2025-34234 · Unknown · Roadcute Api

Name of the Vulnerable Software and Affected Versions: Roadcute API version 1 Description: An issue in the application allows a remote attacker to execute arbitrary code via an insecure password reset API endpoint. The endpoint fails to validate the identity of the requester properly...

CVE-2025-52395

CVE-2025-52395 affects Roadcute API v1. The vulnerability arises from an insecure password-reset endpoint that fails to validate the requester’s identity, enabling a remote attacker to execute arbitrary code. The issue is rated CVSS v3.1: 9.8 (CRITICAL) with network attack, no privileges required...

Cicool web builder 安全漏洞

Cicool web builder is a website builder from Cicool Inc. A security vulnerability exists in Cicool web builder version 3.4.4, which originates from allowing an attacker to reset the administrator password via the /administrator/auth/resetpassword endpoint...

CVE-2020-35674

BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membershippasswordReset.php the endpoint that is responsible for issuing self-service password resets. An unauthenticated attacker is able to send a request containing a crafted payload that can...

Cross-site Request Forgery (CSRF)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the endpoints /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset, and /rag/api/v1/reset/uploads. An attacker can manipulate the application's state and...

CVE-2025-27506 NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page

NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to...

NocoDB 跨站脚本漏洞

NocoDB is an open source Airtable alternative. Convert any MySql, PostgreSql, Sql Server, Sqlite and MariaDb to a smart spreadsheet. A cross-site scripting vulnerability exists in NocoDB versions prior to 0.258.0, which stems from the lack of effective filtering and escaping of user-supplied data...

PT-2025-9998

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.258.0 Description The issue concerns a Reflected Cross-Site-Scripting vulnerability in the password reset function of NocoDB. The API endpoint "/api/v1/db/auth/password/reset/:tokenId" is affected. This flaw is cause...

The vulnerability of the Grafana monitoring and observation platform, related to the disclosure of confidential information to unauthorized entities, allows attackers to gain access to confidential data.

The vulnerability of the Grafana monitoring and observation platform lies in the use of a forgotten password. A POST request is sent to the URL /api/user/password/sent-reset-email during system login. Exploiting this vulnerability could allow an attacker to gain access to confidential data...

PT-2024-21647

Name of the Vulnerable Software and Affected Versions CKAN versions prior to 2.9.11 CKAN versions prior to 2.10.4 Description A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log...

CKAN Log Information Disclosure Vulnerability

CKAN is an open source Dms data management system. It is used to power data centers and data portals. A security vulnerability exists in CKAN 2.0 and later versions that stems from a log injection vulnerability in the reset user endpoint...

PT-2024-21393 · Unknown · Klik Socialmediawebsite

Name of the Vulnerable Software and Affected Versions: KLiK SocialMediaWebsite version 1.0.1 Description: A reflected cross-site scripting XSS vulnerability may allow remote attackers to execute arbitrary JavaScript in the web browser of a user. This can be achieved by including a malicious paylo...